Remember how WhatsApp vowed that it will never share user data with Facebook when Mark Zuckerberg and Co. announced the multi-billion dollar purchase of the popular chat app a few years ago? Or how Facebook told regulators that it wouldn’t be possible to link WhatsApp and Facebook account? Or how Facebook then said that it’ll link your WhatsApp and Facebook accounts automatically unless you opt out?
All that action got Facebook into some hot waters in Europe, and the giant social network just agreed not to use WhatsApp user data in the UK — for now at least.
Facebook settled with the UK’s Information Commissioner’s Office (ICO), according to TechCrunch, and the latter closed its investigation.
The ICO concluded that WhatsApp and Facebook can’t legally share user data at the moment. WhatsApp does share data with Facebook, with the latter labeled as a “data processor” but that means Facebook will not have to face any fines in Britain.
Information Commissioner Elizabeth Denham explained what data processor actually means:
My investigation has not been concerned about WhatsApp’s sharing of personal data with Facebook when Facebook are only providing a support service to WhatsApp. The technical term for such sharing is that WhatsApp can use Facebook as a data processor. This is common practice and if done consistently with the law, under contract, does not generally raise data protection concerns.
Facebook agreed last May to pay a fine in a similar investigation over in Europe that amounted to €110 million. The European Commission fined Facebook for misleading regulators about its technical capacities of matching WhatsApp and Facebook users.
Denham did say ICO identified four issues with WhatsApp sharing data with Facebook:
1. WhatsApp has not identified a lawful basis of processing for any such sharing of personal data;
1. WhatsApp has failed to provide adequate, fair processing information to users in relation to any such sharing of personal data;
2. In relation to existing users, such sharing would involve the processing of personal data for a purpose that is incompatible with the purpose for which such data was obtained;
3. I found that if they had shared the data, they would have been in contravention of the first and second data protection principles of the Data Protection Act.
ICO also said that WhatsApp agreed not to share personal data with Facebook until the two services can do it in a way that adheres to the General Data Protection Regulation (GDPR).
That GDPR acronym you may have seen in various privacy-related articles around the web refers to a new set of regulations that should force tech companies to offer customers better means of protecting their data. The new rules come into effect this May across Europe, which means internet companies that operate in the region, Facebook and WhatsApp included, will have to make various changes to their privacy policies.
Germany already banned Facebook from using WhatsApp user data, and the French data protection authority (CNIL) has its own enforcement action against WhatsApp. The ICO’s announcement says there are other EU data protection authorities that have ongoing investigations.
