On the case of Whatsapp and the alleged privacy issues for data exchange with Facebook, now the European guarantors intervene: they have asked for an urgent investigation to the Irish Privacy Authority (Facebook, which controls WhatsApp, has its European headquarters in Ireland).
The intervention of the privacy guarantors on WhatsApp
“Considering the high probability of breaches for security purposes, the protection and the integrity of WhatsApp and other Facebook companies, as well as for the purposes of improving the products of Facebook companies, the Edpb (precisely the EU Privacy Guarantors) considered that the matter requires further rapid investigations – reads in a note dated July 15 – Specifically to check if Facebook companies are carrying out processing operations that involve combining or comparing user data of WhatsApp with other series of data processed by other Facebook companies in the context of other apps or services offered by Facebook companies, facilitated among other things by the use of unique identifiers (of the user, ed) “.
Edpb asks the Irish authority “to carry out an investigation to determine if such processing activities are pending or not and, if so, whether they have an adequate legal basis pursuant to Article 5 (1) (A) and Article 6 (1) of gdpr”.
In short, Edpb is also worried about the scarce information available: “Taking into consideration the lack of information regarding the methods of data processing for marketing purposes, cooperation with other Facebook companies and in relation to WhatsApp Business Api, Edpb invites Ie Sa (the Irish Privacy Authority, ed) to investigate the role of Facebook Ireland, ie whether Facebook acts as a data controller or as a joint controller with regard to these processing operations “.
The Edpb was called into question by the German Privacy Authority, which requested an urgent intervention from the Irish one, which would have made it possible to extend a blocking of data processing by WhatsApp throughout Europe. In this regard, “the Edpb has decided that the conditions for proving the existence of a violation and the urgency are not met. Therefore, the Edpb has decided that it is not necessary for the IE SA to adopt definitive measures against Facebook in this case ”.
In short, if on the one hand it blocks the Privacy Authority from intervening, on the other pushes the Irish one to do her job.
The fight
EU consumers denounce WhatsApp: “Pressure to accept the new privacy policy”
The reason for the dispute
The problem, as told on Italian Tech, concerns the new privacy policy of WhatsApp, entered in force in May after a long queue of controversy and concerns from users (some of which have even migrated to other platforms).
Outside of Europe, the Indian government has repeatedly ordered to Facebook to withdraw the news, while in Europe, privacy regulators and consumer protection organizations have raised objections to the lack of transparency of the privacy disclosure.
Mostly the German authorities in Hamburg attacked: in May he ordered Facebook not to apply the new privacy terms to users in Germany and also accused the Irish supervisor of not having investigated the sharing of data between Facebook and WhatsApp.
Hence the action of the Edpb, an instrument envisaged by article 66 of the GDPR: “Since the Irish Authority was dozing, all the other authorities gathered in the Edpb told it to act immediately”, he explained. Franco Pizzetti, former Privacy Guarantor and emeritus professor of Constitutional Law in Turin.
The case
WhatsApp, the battle for interoperability moves to Brussels
by Arthur of Corinth
The powers of article 66
The importance of article 66 of the GDPR is that it allows the EU data protection authorities to derogate from the one-stop-shop mechanism of the regulation, which otherwise channels cross-border complaints (such as those against tech giants) through a lead data supervisor (often the Irish one). However, this mechanism is widely seen as a bottleneck for effective data protection enforcement, especially against technology giants.
According to Pizzetti, “the Irish guarantor, like Ireland itself, has little interest in pursuing these companies, which bring business to their homeland: Germany’s intervention also has a geopolitical flavor. Germany and France are at the forefront in asking Europe to make Europe, that is, to guarantee control over citizens’ data and the consequent data economy ”.
The possible implications
For its part, the Deputy Commissioner of Hamburg for Data Protection, Ulrich Kühn, he expressed disappointment, explaining that he would have preferred an urgent intervention by the Edpb, “while this is a non-binding decision”. Although of undoubted political weight, as Pizzetti also acknowledged, and therefore not entirely ignorable by the Irish Authority.
Second the lawyer Diego Di Malta, an expert on privacy issues, “This is a victory for all of us who immediately lit a beacon on the matter even against those who minimized trying to calm the mind and passing the message that in the EU with the new privacy policy nothing would have changed because of the GDPR. They were unlikely positions, we said it right away and now the Edpb agrees with us ”.
the decision
Privacy, the reverse of WhatsApp: it will not limit chats to those who do not accept the update
by Simone Cosimi
Facebook said it “welcomed the decision of the Edpb not to extend the order of the Hamburg Privacy Authority, which was based on fundamental misunderstandings about the purpose and effect of updating our terms of service. We remain fully committed to providing secure and private communications for all and will work with the Irish Data Protection Commission as our main regulator in the region to fully address the issues raised by the Edpb. “
.