WHATSAPP IRELAND HAS been fined €5.5 million for breaches of GDPR.

The Data Protection Commission (DPC) has also announced that WhatsApp Ireland has been given six months to bring its data processing operations into compliance.

The EU’s General Data Protection Regulation, or GDPR, was adopted in 2016 and came into force on 25 May, 2018.

GDPR’s primary aim is to enhance people’s control and rights to their personal data.

The DPC inquiry concerned a complaint made on 25 May, 2018.

In advance of 25 May 2018, the date on which the GDPR came into operation, WhatsApp Ireland updated its Terms of Service.

Users were informed that if they wished to continue to have access to the WhatsApp service following the introduction of the GDPR, existing (and new) users were asked to click “agree and continue” to indicate their acceptance of the updated Terms of Service.

The WhatsApp services would not be accessible if users declined to do so.

In a statement issued today, the DPC outlined that WhatsApp Ireland considered that a  contract was entered into between WhatsApp Ireland and the user, upon the user accepting the updated Terms of Service.,

WhatsApp Ireland also took the position that the processing of users’ data in connection with the delivery of its service was necessary for the performance of that contract, including the provision of service improvement and security features, so that such processing operations was lawful under GDPR regulations.

However, the complainant contended that, contrary to WhatsApp Ireland’s stated position, WhatsApp Ireland was seeking to rely on consent to provide a lawful basis for its processing of users’ data.

The complainant argued that, by making the accessibility of its services conditional on users accepting the updated Terms of Service, WhatsApp Ireland was “forcing” them to consent to the processing of their personal data for service improvement and security.

The complainant argued that this was in breach of the GDPR.

Following a “comprehensive investigation”, the DPC found that information in relation to the legal basis relied on by WhatsApp Ireland was not clearly outlined to users.

This was described as a “breach of its obligations in relation to transparency” and resulted in users having “insufficient clarity as to what processing operations were being carried out on their personal data, and for what purposes”.

While the DPC considered this to be in contravention of GDPR, it did not impose a fine because WhatsApp Ireland had already been hit with a substantial fine of €225 million for similar breaches over the same period.

The DPC then went on to consider whether WhatsApp Ireland was obliged to rely on consent as its legal basis in connection with the delivery of the service, including for service improvement and security purposes.

While there was disagreement with peer regulators in the EU over this issue, the European Data Protection Board (EDPB) found that WhatsApp Ireland “was not entitled to rely on the contract legal basis as providing a lawful basis for its processing of personal data for the purposes of service improvement and security”.

In light of this additional infringement of the GDPR, the DPC imposed an administrative fine of €5.5 million on WhatsApp Ireland, and ordered WhatsApp Ireland to bring its processing operations into compliance with the GDPR within six months.

The EDPB has also directed the DPC to conduct a fresh investigation that would span all of WhatsApp Ireland’s processing operations in order to determine if it complies with the relevant obligations under the GDPR.

However, the DPC’s said its decision “does not include reference to fresh investigations of all WhatsApp data processing operations”.

The DPC added that this “direction is problematic in jurisdictional terms” and that this “direction may involve an overreach on the part of the EDPB”.

The DPC will bring an action for annulment before the Court of Justice of the European Union in order to seek the setting aside of the EDPB’s direction, which the DPC said would result in an “open-ended and speculative investigation”.