German Whatsapp user (represented by noyb - European Centre for Digital Rights) – Order (European Union, 2022)

In order to access Whatsapp, an online instant messaging platform ultimately owned and controlled by “Meta Platforms Inc.”, a user was required to accept a series of terms and conditions (the “Terms of Service”) and a Privacy Policy. In accordance with the GDPR, Whatsapp IE was obliged to have a lawful basis for the processing of any personal data they undertook. Article 6(1) GDPR detailed the lawful bases upon which such data can be processed. The company was also obliged to provide detailed information to users at the time their personal data was obtained in relation to, among others, the purposes of any data processing and the legal basis for such processing. To continue to access the Whatsapp platform, all users were required to accept the updated Terms of Service and privacy policy prior to 25 May 2018, the date the GDPR became applicable. Those existing users who were not willing to accept the new terms were advised of the option to delete their Whatsapp account. A German Whatsapp user, the “data subject” and “complainant”, filed a complaint against Whatsapp IE, the controller. The complainant was represented by “noyb – European Centre for Digital Rights”, a privacy NGO based in Austria. The complainant alleged that Whatsapp IE’s data processing practices on the Whatsapp platform amounted to “forced consent”, and constituted a violation of the GDPR. The complaint, originally filed with the Hamburg DPA (HmbBfDI) and later transferred to the German Federal DPA (BfDI), advanced a number of grounds upon which the consent of the data subject could not be considered “freely given”. Firstly, there existed a clear imbalance of power between the controller and the data subject. This was likely to affect the voluntariness of the latter’s consent for the processing of personal data. The complaint alleged that, in this case, the controller undisputedly had a dominant market position in the area of social networking services and, in combination with the “lock in” and “network” effects, the data subject was left with no other realistic alternatives. Secondly, the use of the Whatsapp service was conditional upon the data subject’s consent to collection of their data, when such data processing is not necessary for the provision of the service. Article 7(4) GDPR, which defines the conditions for consent, specifically states that “utmost account shall be taken of whether, inter alia, the performance of a contract… is conditional on consent to the processing that is not necessary for the performance of that contract”. As such, the “consent” upon which the controller seeks to rely was invalid. Additionally, the complaint raises the issue of granularity, as the controller relies on an overall bundled consent to anything contained in the terms and the privacy policy. This represents an “all-or nothing” approach contrary to the requirement of the GDPR for “specific” consent to processing. Finally, the controller shall enable the data subject to refuse consent without any detriment. However, in this case, the data subject faces significant disadvantage, as their account would be deleted – as a consequence of withdrawal – and they would lose a crucial form of social interaction. The BfDI referred the case to the Irish DPA (DPC) under Article 56 GDPR, and in accordance with the procedure outlined in Article 60 GDPR. Responding to the Complainant’s assertions Whatsapp IE submitted, among other points, that it does not rely on consent as the lawful basis for the relevant processing of personal data. According to the company, “the legitimization of the processing at issue in this inquiry falls under Article 6(1)(b) GDPR [necessary for the performance of a contract] and therefore an assessment under Article 6(1)(b) only is required”. (DPC Preliminary Draft Decision, para 3.4) On 1 April 2022, the DPC shared its Draft Decision with the other Data Protection Authorities (DPAs) in accordance with Article 60(3) GDPR. Six DPAs (DE, FI, FR, IT, NL, NO) raised objections, in accordance with Article 60(4) GDPR, to the Draft Decision. On 19 August 2022, the matter was referred to the European Data Protection Board (EDPB). The EDPB adopted a binding decision on 5 December 2022 and the DPC issued its Final Decision on 12 January 2023, published on 19 January 2023. Issuing its Binding Decision, the EDPB decided on the admissibility of the objections raised by the DPAs. For each issue, the EDPB determined whether the objection can be considered a “relevant and reasoned objection” within the meaning of Article 4(24) GDPR. The EDPB identified five issues in the case at hand, addressing each one in turn before issuing the Binding Decision. Please note: in order to explain the issues addressed in the decision, it is necessary to explain the proposals in the DPC’s Draft Decision, in order to provide the context for the EDPB decision. Issue 1 – On Whether the LSA (DPC) Should Have Found an Infringement for Lack of Appropriate Legal Basis The first issue concerns whether Whatsapp IE can rely on Article 6(1)(b) GDPR as the lawful basis for processing of personal data. In order to do so, the controller has to demonstrate that such “processing is necessary for the performance of a contract to which the data subject is a party”. When issuing its Draft Decision, the DPC firstly sought to address the question of scope – identifying which processing practices they are concerned with in this context – before moving to the question of contractual necessity as a lawful basis. Summarising the DPC’s position on the question of scope, they asserted that their inquiry must be limited to the processing of personal data for “service improvements” and “security”. In doing so, the DPC elected not to conduct an investigation into the processing of sensitive categories of data, as well as data processed for the purposes of: behavioural advertising; providing metrics to third parties; and marketing. Responding to this proposal, the EDPB disagreed with the DPC's conclusions regarding the scope of the inquiry, and directed the DPC to commence a new inquiry into the Whatsapp's processing of special categories of personal data, and their processing for the purposes of: behavioural advertising; marketing; and providing metrics to third parties (222). The DPC did not conduct this inquiry as, in their view, “that direction cannot be addressed… in this decision” and proceeded in their analysis, continuing to exclude questions of data processed for advertising. For further discussion of the issue of scope, and the EDPB’s directions regarding a further investigation, please see “Issue 3 – On the Further Investigation” below. Addressing the second question, whether the data processing is necessary for the purpose of a contract between Whatsapp IE and its users, the DPC agreed with the complainant’s submissions and the EDPB guidelines that “the ‘core’ functions of a contract must be assessed in order to determine what processing is objectively necessary in order to perform it” (DPC - 3.27). However, the DPC added that “necessity is to be determined by reference to the particular contract” (DPC - 3.27) and “it is not for an authority such as the [DPC], tasked with the enforcement of data protection law, to make assessments as to what will or will not make the performance of a contract possible” (DPC - 3.45). The DPC took a broad approach to determining what is necessary for the performance of a contract based on “the actual bargain which has been struck between the parties” (DPC - 3.30). The DPC stated “it seemed to me… that Whatsapp’s model and the service being offered is explicitly one that includes improvements to an existing service, and a commitment to upholding certain standards relating to abuse, etc., that is common across all affiliated platforms” (DPC - 3.42). Accordingly, the Draft Decision “proposed to conclude... that WhatsApp was, in principle, entitled to rely on Article 6(1)(b) GDPR for processing personal data” (DPC - 3.50). In response, when issuing its Binding Decision with regard to Article 6(1)(b) GDPR as a lawful basis for data processing and the determination of what is necessary for the performance of a contract, the EDPB stated as follows:“The EDPB agrees with the IE SA and Whatsapp IE that there is no hierarchy between these legal bases. However, this does not mean that a controller, as Whatsapp IE in the present case, has absolute discretion to choose the legal basis that suits better its commercial interests. The controller may only rely on one of the legal basis established under Article 6 GDPR if it is appropriate for the processing at stake" (100). "The GDPR makes Whatsapp IE, as a data controller for the processing at stake, directly responsible for complying with the Regulation’s principles, including the processing of data in a lawful, fair and transparent manner, and any obligations derived therefrom. This obligation applies even where the practical application of GDPR principles… is inconvenient or runs counter to the commercial interests of Whatsapp IE and its business model” (101). "The EDPB agrees that SAs do not have under the GDPR a broad and general competence in contractual matters. However, the EDPB considers that the supervisory tasks that the GDPR bestows on SAs imply a limited competence to assess a contract's validity, insofar as it is relevant to the fulfilment of their tasks under the GDPR" (102). “...it is important to determine the exact rationale of the contract, i.e. its substance and fundamental objective, as it is against this that it will be tested whether the data processing is necessary for its performance” (105). "the concept of necessity has its own independent meaning under EU law. It must be interpreted in a manner that fully reflects the objective pursued by an EU instrument, in this case, the GDPR" (110).Turning to the facts of the case, the EDPB outlines a number of factors which, in contradiction to the view of the DPC, support the argument that data processing for service improvements and security is not essential to the contract between Whatsapp IE and its users. The EDPB observes that Whatsapp is under a duty to consider the possibility of less intrusive ways to pursue the stated purpose, for example, “rely on a pool of users, who voluntarily agreed, by providing consent, to the processing of their personal data for this purpose” (109). Furthermore, the EDPB points to an imbalance of knowledge surrounding the contract, “an average user cannot fully grasp what is meant by processing for service improvements and security features, be aware of its consequences and impact on their rights to privacy and data protection, and reasonable expect it solely based on Whatsapp IE’s Terms of Service” (111). As explained by the EDPB, the DPC has already acknowledged that Whatsapp IE infringed its transparency obligations under the GDPR (see “Issue 3” in DPC Decision [https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_Whatsapp_Ireland_Limited_-_IN-18-5-6 IN-18-5-6]), and this undermines the argument that the processing is lawful on the basis of contractual performance. This is because, “one of the parties (in this case a data subject) [has not been] provided with sufficient information to know they are signing a contract, the processing of personal data that it involves, for which specific purposes and on which legal basis, and how this processing is necessary to perform the services delivered… These transparency requirements are not only an additional and separate obligation, but also an indispensable and constitutive part of the legal basis” (117). The EDPB continues, outlining the inherent risk of a finding in the DPC’s decision that Whatsapp IE can process personal data on the basis of Article 6(1)(b) GDPR:“...there is a risk that the Draft Decision’s failure to establish Whatsapp IE's infringement of Article 6(1)(b) GDPR, pursuant to the interpretation by the [DPC], nullifies this provision and makes theoretically lawful any collection and reuse of personal data in connection with the performance of a contract with a data subject" (119). “This precedent could encourage other economic operators to use the contractual performance legal basis of Article 6(1)(b) GDPR for all their processing of personal data. There would be the risk that some controllers argue some connection between the processing of the personal data of their consumers and the contract to collect, retain, and process as much personal data from their users as possible and advance their economic interests at the expense of the safeguards for data subjects” (120).In light of all of the above, the EDPB directed the following:“processing for the purposes of service improvements and security features performed by Whatsapp IE are objectively not necessary for the performance of Whatsapp IE's alleged contract with its users and are not an essential or core element of it" (121). "Whatsapp IE has inappropriately relied on Article 6(1)(b) GDPR to process the complainant's personal data for the purposes of service improvements and security in the context of its Terms of Service and therefore lacks a legal basis to process the data. The EDPB was not required to examine whether data processing for such purposes could be based on other legal bases because the controller relied solely on Article 6(1)(b) GDPR. Whatsapp IE has consequently infringed Article 6(1) GDPR by unlawfully processing personal data” (122).Accordingly, the EDPB instructed the DPC to alter “Finding 2” of its Draft Decision to include a finding that Whatsapp IE was not entitled to rely on Article 6(1)(b) GDPR to process the Complainant’s personal data in this context, and to find an infringement of Article 6(1) GDPR based on the shortcomings the EDPB has identified (122). Issue 2 – On the Potential Infringement of the Principles of Fairness, Purpose Limitation and Data Minimisation During the course of the Article 60 GDPR consultation period, the Italian DPA raised two objections to the DPC’s Draft Decision. The Italian DPA asserted that the Draft Decision should be amended to include a separate finding of an infringement of the Article 5(1)(a) GDPR principle of fairness, and infringements of the Article 5(1)(b) and (c) GDPR principles of purpose limitation and data minimisation. Potential infringement of principles of purpose limitation and data minimisation: The Italian DPA explained that the fact that Whatsapp IE’s multifarious processing practices involving personal data are grounded in Article 6(1)(b) GDPR entails an infringement of the principles of purpose limitation and data minimisation. This is because the purposes must have been specified and communicated to data subjects. In response, the DPC stated that it did not consider that the Italian DPA’s objection to be relevant or reasoned. In contrast, the EDPB stated that it did consider the Italian DPA’s objection to be “relevant” as it includes justifications concerning why and how issuing a decision with the changes proposed in the objection is needed and how the change could lead to a different conclusion. However, the EDPB found that the objection did not sufficiently demonstrate that there is a “substantial and plausible” risk to the fundamental rights and freedoms of data subjects. Therefore, while the objection is relevant, it is “not reasoned” so as to satisfy Article 4(24) GDPR. Potential infringement of the principle of fairness: The objection raised by the Italian DPA sought an additional finding of an infringement of the principle of fairness in Article 5(1)(a) GDPR. In its Draft Decision, the DPC decided not to follow the objection, as the “principle of fairness was not examined during the course of this inquiry and, consequently, Whatsapp was not afforded the opportunity to be heard in response to a particularised allegation of wrongdoing” (DPC - 5.1). The matter was referred to the EDPB, which determined the objection raised by the Italian DPA to be both relevant and reasoned in accordance with Article 4(24) GDPR, and stated as follows:“Fairness is an overarching principle which requires that personal data should not be processed in a way that is unjustifiably detrimental, unlawfully discriminatory, unexpected or misleading to the data subject” (143). "...the principle of fairness has an independent meaning and… an assessment of Whatsapp IE’s compliance with the principle of transparency does not automatically rule out the need for an assessment of Whatsapp IE’s compliance with the principle of fairness too" (147). "the concept of fairness stems from the EU Charter… [it] underpins the entire data protection framework and seeks to address power asymmetries between controllers and data subjects in order to cancel out the negative effects of such asymmetries and ensure the effective exercise of the data subjects’ rights” (148). “Considering the constantly increasing economic value of personal data in the digital environment, it is particularly important to ensure that data subjectsare protected from any form of abuse and deception, intentional or not, which would result in the unjustified loss of control over their personal data… Therefore, the EDPB disagrees with the [DPC]’s finding that assessing Whatsapp IE’s compliance with the principle of fairness ‘would therefore… represent a significant departure from the scope of the inquiry.’ In addition, it is important to note that Whatsapp IE has been heard on the objections and therefore submitted written submissions on this matter” (150). “Whatsapp has presented its service to users in a misleading manner… The combination of factors, such as the unbalanced relationship between Whatsapp IE and its users, combined with the ‘take it or leave it’ situation that they are facing… systematically disadvantages them, limits their control over the processing of their personal data and undermines the exercise of their rights” (154, 156).Accordingly, the EDPB instructed the DPC to include a finding of an infringement of the principle of fairness under Article 5(1)(a) of the GDPR by Whatsapp IE, and to “adopt the appropriate corrective measures, by addressing, but without being limited to, the question of an administrative fine for this infringement” (157). Issue 3 – On the Further Investigation As discussed in “Issue 1” above, the DPC reached certain conclusions on the scope of their inquiry, limiting their analysis to personal data processing for the purposes of “service improvements” and “security”. In their draft Decision, the DPC explained that that their analysis will be based only on the Whatsapp Terms of Service, and not the Privacy Policy. In their view, the Privacy Policy is essentially an explanatory document for the purposes of transparency, and not part incorporated within the terms of service (DPC 3.4 – 3.5). The DPC then takes issue with the generality, or vagueness, of the complaint which – in their view – does not identify “specific processing operations by reference to an identifiable body of data with any clarity of precision” (DPC - 3.6). Furthermore, according to the DPC, the complainant was not entitled to request that the DPC “conduct an assessment of all processing operations carried out by Whatsapp” (DPC - 3.6). After stating that “the Complaint does, however, focus on a number of particular processing activities and has a specific focus on data processed to facilitate improvements to services and advertising” (DPC - 3.7), the DPC explains that their Draft Decision proposed an assessment of whether Whatsapp IE can rely on Article 6(1)(b) GDPR for data processing for service improvements, providing metrics to third parties (such as companies within the same group of companies), and advertising. However, on the question of advertising, the DPC states that “no evidence has been presented by the Complainant that Whatsapp processes personal data for the purpose of advertising” (DPC - 3.8), and therefore data processing for advertising is not relevant to this inquiry. With regards to “providing metrics to third parties”, the DPC states later in the decision that “any sharing with affiliated companies formed part of the general ‘improvements’ that are carried out pursuant to Article 6(1)(b) GDPR” (DPC - 3.33). Therefore, the DPC took the view that providing metrics to third parties forms part of service improvements as “any clear delineation between these two forms of processing was artificial” (DPC - 3.33). As a result, the DPC restricted the scope of their inquiry to “regular improvements and maintaining standards of security”. During the Article 60 GDPR consultation period, 3 DPAs (FI, FR, IT) raised objections to the conclusions reached by the DPC in the Draft Decision. The objections requested that the DPC further investigate matters of behavioural advertising, special categories of personal data, the provision of metrics to third parties, including companies belonging to the same group, and marketing. (168 – see also 169 – 174). In response, the DPC stated that it does not propose to “follow” the objections raised, and the matter was referred to the EDPB. Issuing its Binding Decision, the EDPB disagreed with the DPC’s assessment of scope, and found the objections raised both relevant and reasoned in accordance with Article 4(24) GDPR. Regarding specifically the question of special categories of personal data, the EDPB notes that the GDPR and case law pay close attention to the processing of such data, and that the complaint expressly requests the DPC to investigate Whatsapp IE’s processing operations in this area (215). The EDPB outlines the risk of the DPC’s failure to address the issue of special categories of personal data including: the use of this data to build intimate profiles of users; the failure to recognise it as a special category of personal data; ignoring the role of consent in the processing; and setting a precedent of ambiguity and transparency which could be followed by other controllers (see 217). They also assert that the DPC “did not handle the complaint with all due diligence” and that the lack of any further investigation into processing for behavioural advertising, of special categories of personal data, provision of metrics to third parties, exchange with affiliated companies, and processing for the purposes of marketing, was an omission (218). Taking into account the limited scope of the inquiry and lack of assessment by the DPC, the EDPB decided that the DPC “shall carry out an investigation into Whatsapp IE’s processing operations in its service to determine if it processes special categories of data” and to investigate the processing for all of the above purposes in order to determine if Whatsapp IE complied with its obligations under the GDPR. The EDPB also instructs the DPC to issue a new Draft Decision, based on the results of that investigation and the findings (222). It is worthy to note, at this stage, that the DPC did not conduct this further investigation as, in their view, “that direction cannot be addressed… in this decision” and proceeded in their analysis, continuing to exclude questions of data processed for advertising. For further discussion, please see [https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_Whatsapp_Ireland_Limited_-_IN-18-5-6 DPC (Ireland) – Whatsapp Ireland Limited – IN-8-5-6] (discussion of “Issue 2”). Issue 4 – On Corrective Measures Other than Additional Fines In its Draft Decision, the DPC did not find any infringement of Article 6(1)(b) GDPR and so was not in a position to consider the application of its corrective powers as provided for in Article 59(2) GDPR. The DPC did consider that Whatsapp IE had infringed its transparency obligations under the GDPR, however, they had dealt with this issue in a previous own-volition inquiry and imposed an administrative fine and order to bring processing into compliance. A number of objections were raised to the lack of corrective measures in the Draft Decision to address the infringement of Article 6(1) GDPR. Most notably, the Finnish DPA stated that the DPC should use its corrective powers to at least order Whatsapp IE to bring its processing operations into compliance with Article 6(1) GDPR. Also, the DPC should consider the imposition of an administrative fine. After reviewing the merits of the objection, the EDPB instructed the DPC “to include in its final decision an order for WhatsApp IE to bring its processing of personal data for the purposes of service improvement and security features in the context of its Terms of Service into compliance with Article 6(1) GDPR” (274). Issue 5 – On the imposition of the administrative fine During the Article 60 GDPR consultation period, four DPAs (FR, NO, DE, IT) objected to the failure of the DPC to take action with respect to one or more specific infringements and asked the DPC to impose an administrative fine. After considering the objections in light of Article 4(24) GDPR and the factors outlined in Article 83(2) GDPR the EDPB instructed the DPC to impose an administrative fine for the infringement of Article 6(1) GDPR (314) and, in doing so, to take into account the infringement of the principle of fairness in Article 5(1)(a) GDPR (320).