Following the EDPB’s binding dispute resolution decision of December 5th, WhatsApp IE was issued a 5.5 million euro fine by the Irish Data Protection Authority (DPA).

In its Binding Decision, the EDPB instructed the IE DPA to amend its draft decision concerning the findings concerning the lawfulness of the processing the principle of fairness, and the corrective measures envisaged.

Regarding the lawfulness of processing for Service improvement purposes, the EDPB decided that WhatsApp IE inappropriately relied on contract as a legal basis to process personal data. As a consequence, the EDPB instructed the IE DPA to add an infringement of Art. 6(1) GDPR. Additionally, the EDPB instructed the IE DPA to include an infringement of the principle of fairness under Art. 5(1)(a) GDPR.

The EDPB further decided that the IE DPA must investigate WhatsApp IE’s processing operations to determine whether it processes special categories of personal data (Art. 9 GDPR); whether it processes data for behavioral advertising, marketing purposes, as well as for the provision of metrics to third parties and the exchange of data with affiliated companies for service improvements.

For corrective measures, the EDPB requested the IE SA to include in its final decision an order for WhatsApp IE to bring its processing of personal data for service improvement in the context of its Terms of Service into compliance with Art. 6(1) GDPR within a specified period, and to cover the infringements of Art. 6(1) GDPR with an administrative fine.

Source; https://edpb.europa.eu/news/news/2023/edpb-publishes-binding-decision-concerning-whatsapp_en