German Regulator Orders Facebook to Cease Collecting WhatsApp User Data

October 24, 2016

Facebook EuropeThe Hamburg Commissioner for Data Protection and Freedom of Information (the Commissioner) recently ordered Facebook to cease collection and use of personal information obtained from users of the popular app, WhatsApp, in Germany.  This dispute illustrates the extent to which privacy regulators in diverse jurisdictions are now attentive to a range of online activities and platforms.

The Commissioner alleges that WhatsApp collects, stores, and analyzes a range of personal information, telephone numbers and e-mail addresses for example, from its users.  There are reportedly approximately 35 million WhatsApp users in Germany.  As Facebook acquired ownership of WhatsApp, the Commissioner contends that the personal information collected from those users is now routinely shared with Facebook.  Acquisition of companies in order to gain access to consumer data seems to be an increasingly popular strategy for businesses in a variety of markets,

The Commissioner claims that WhatsApp users were not provided effective notice that the information collected from them would be shared with Facebook.  European and German law require that effective notice Matsuura Blakeley Bannermust be provided to consumers prior to collection or use of their personal information.  The Commissioner determined that the sharing of the information with Facebook was a violation of privacy law, and it required that Facebook cease accessing and using the customer information.  Without specific authorization from the consumers involved, sharing of personal information among distinct entities is not permissible under European and German rules, even if there is an ownership relationship connecting the entities.

Facebook contends that it uses the consumer information to improve the quality of the WhatsApp service.  It notes that some of the information it collects from users is applied to reduce unsolicited commercial e-mail and to customize its service offerings to make them more responsive to the interests of individual consumers.  Facebook argues that consumers benefit as a result of the sharing of the user data between WhatsApp and Facebook.  Facebook reportedly indicated its intention to appeal the decision of the Commissioner.

It seems that the facts in this dispute may be complicated by an apparent change in the WhatsApp privacy practices.  The Commissioner alleges that WhatsApp and Facebook initially indicated to users that there would not be sharing of user information between the two companies, even after the Facebook acquisition.  The Commissioner claims, however, that the privacy practices later changed to permit the information sharing, without effective notice to users of the change.

This case illustrates the importance of presenting clear, effective notice to consumers describing what personal information will be collected, who will have access to it, and how it will be used.  It also highlights the challenges associated with sharing consumer information among distinct legal entities.  Such sharing must be actively and carefully managed to ensure compliance with all applicable legal requirements.  Additionally, the case underscore the need to ensure that privacy notices always match the actual operational practices associated with the information involved.  Before changes are made with regard to collection, access or use of consumer information, the organizations involved must act to ensure that their privacy notices and authorizations are fully consistent with the new information management practices.