The Irish Data Protection Commission (DPC) has fined the messaging service WhatsApp €225 million for breaches of the GDPR, the EU’s online privacy regulation.
The fine is the second-largest handed out for GDPR offences after Amazon was fined €746 million in July by the data protection authority in Luxembourg.
The General Data Protection Regulation (GDPR) is the law within the EU on data protection, and also applies to anyone operating internet services within the territory. It is also the reason why whenever we visit an internet website, we have to give permission for cookies and what sort of cookies.
The GDPR came into force in May 2018 and allows privacy watchdogs in Member States to fine companies for breaches worth up to 4% of their worldwide income.
For companies like WhatsApp and its parent Facebook, that presents a huge liability in the case of breaches, and Facebook has lost several cases brought by the DPC and later appealed to the European Court of Justice.
Ireland is a popular seat for multinationals as it was fairly relaxed on matters such as data transfer – sending data on EU users to head offices in the US. However, since the introduction of the GDPR the Irish DPC has been one of the prime movers in enforcement.
This case concerned how WhatsApp communicated user data to its parent company, and how it dealt with data from users and non-users.
Users of apps such as WhatsApp may not realise that the cookies they so quickly agree to include tracking cookies, which not only look at their WhatsApp data but then follow them on the internet tracking their activity elsewhere.
If WhatsApp tracking cookies can then pass that data back to Facebook, it adds to the mountain of data Facebook already holds on so many of us, from birthdays to holidays to jobs and myriad other personal information.
WhatsApp, reports said, had set aside a fund of €77.5 million to cover the fine it expected. The actual fine is almost three times as large. The company intends to appeal.
“We do not agree with the decision about the transparency we offered to people in 2018. The penalties are disproportionate. We will challenge this decision," a spokesperson said.
WhatsApp, they said, has always committed to "provide a secure and private service".
"We have worked to ensure that the information we provide is transparent and complete, and we will continue to do so."
