Last week, we reported on publication by the Irish Data Protection Authority of its final decision regarding Facebook and Instagram following the EDPB’s binding dispute resolution decisions of 5 December 2022.

This week, we report on publication of the Irish Data Protection Authority (DPA)’s final decision in relation to the dispute over WhatsApp’s personal data processing for service improvement and publication by the EDPB of its binding decision, adopted on 5 December 2022, in relation to the same.

In its binding decision of 5 December 2022, the EDPB found that WhatsApp Ireland had wrongly relied on contract as a legal basis to process personal data for service improvement. Accordingly, the EDPB instructed the Irish DPA to add infringement of Article 6(1) of the GDPR to its draft decision. Additionally, the EDPB instructed the Irish DPA to include an infringement of the principle of fairness under Article 5(1)(a) of the GDPR.

The EDPB also decided that the Irish DPA must carry out an investigation into WhatsApp Ireland’s processing operations to determine: (i) whether it was processing special categories of personal data (Article 9 of the GDPR); and (ii) whether it was processing data for behavioural advertising and marketing purposes, as well as to provide metrics to third parties and data to affiliated companies for the purposes of service improvements.

The EDPB instructed the Irish DPA to include in its final decision an order for WhatsApp IE to bring its processing of personal data for the purposes of service improvement into compliance with Article 6(1) within a certain time and to issue an administrative fine for the infringements of Article 6(1).

Following the EDPB’s binding decision in December 2022, WhatsApp Ireland was issued with a total fine of €5.5 million. To access the Irish DPA’s final decision, click here. To access the EDPB’s binding decision of 5 December 2022, click here.