WhatsApp shifts legal basis for processing personal data in Europe

17 July 2023 16:12

WhatsApp updated its privacy policy on July 17 by switching to the ‘legitimate interest’ legal basis following an Irish Data Protection Commissioner’s sanction in January.

The General Data Protection Regulation, the EU privacy framework, requires organisations that process personal data to have a legal basis on which to do so.

In January, Ireland’s data protection authority decided WhatsApp’s legal basis was not sufficiently founded and mandated the instant-messaging app find a new one.

The Data Protection Commissioner is the leading authority for several cross-border cases since most Big Tech companies have their European headquarters in Ireland. The regulator’s decision followed a series of complaints by the digital rights NGO NOYB, led by Austrian activist Max Schrems.

NOYB challenged WhatsApp’s parent company Meta’s ‘contract’ legal basis. Before the EU’s privacy law entered into application, every Meta-owned platform changed its terms and conditions to state that, by using the service, users agreed to the processing of their personal data for service improvement and security.

While the Irish privacy watchdog initially sided with Meta, it was overruled by the European Data Protection Board, which gathers all EU data protection authorities. As a result, WhatsApp was sanctioned €5.5 million, while Facebook and Instagram €210 million and €180 million, respectively.

WhatsApp, alongside the other Meta services, has appealed the decision, but in the meantime must comply and shift to a new legal basis, which was found in the idea of ‘legitimate interest’.

According to WhatsApp, under legitimate interest, users will still be able to object to the use of their information.

However, precedents suggest this legal basis might be equally shaky. Last year, the Italian authority warned against using the legitimate interest legal basis for delivering personalised advertising.

Moreover, the European Court of Justice recently ruled that Facebook’s use of personal data to provide online advertising could not be justified without the users’ consent, suggesting that the ‘consent’ legal basis might be the only viable option.

“As ordered by the Irish Data Protection Commission, we have updated the legal basis we rely on for service improvement and security purposes in the European Region. This does not change our commitment to user privacy, and the updates to the European Region privacy policy don’t change the way we treat user data,” a WhatsApp spokesperson told EURACTIV.

The spokesperson added that “wherever you are in the world, we protect all personal messages with end-to-end encryption, which means no one, not even WhatsApp, can read or listen to them”.

The company clarified that the changes will not affect users, encryption, or the sharing of data with other Meta-owned platforms.

Caliber.Az

Views: 421

Liked the story? Share it on social media!