Is WhatsApp compliant with privacy laws? Investigation to decide in 1 month

EU privacy watchdog EDPB on Wednesday gave the Irish data protection agency a month to issue a long-delayed decision on compliance by Facebook’s (FB.O) WhatsApp after its peers objected to its draft finding.

The agency, which leads oversight of Facebook because the company’s European headquarters are based in Ireland, has been investigating WhatsApp to see if it complies with transparency obligations specified by EU privacy rules known as General Data Protection Regulation (GDPR).

It sought feedback from its peers in December but was unable to find a consensus regarding its draft decision.

The other national watchdogs objected to the type of infringements identified by the Irish, whether the specific data in question was personal data and the appropriateness of the proposed sanctions.

The Irish agency said it would not follow the objections and referred them to the EDPB, which on Wednesday adopted a decision addressing the merits of the disagreements but did not provide details.

“The IE SA shall adopt its final decision, addressed to the controller, on the basis of the EDPB decision, without undue delay and at the latest one month after the EDPB has notified its decision,” the EU watchdog, which acts as a referee in disputes among the national agencies, said.

The other national enforcers have long criticised their Irish peer for taking too long to wrap up its investigations and the size of proposed fines.

A number of EU data protection authorities have used (or threatened to use) Article 66 powers in recent years, since GDPR came into application in 2018, and the power is increasingly proving its worth in reconfiguring certain Big Tech practices — with, for example, Italy’s DPA using it recently to force TikTok to remove hundreds of thousands of suspected underage accounts, TechCrunch reports.

Just the threat of Article 66’s use back in 2019 (also by Hamburg) was enough to encourage Google to suspend manual reviews of audio reviews of recordings captured by its voice AI, Google Assistant. (And later led to a number of major policy changes by several tech giants who had similarly been manually reviewing users’ interactions with their voice AIs.)