Tuesday, May 24 2022
download app
download appDOWNLOAD OUR APP
download google-play
download app-store
Emilija Berzanskaite
3rd January 2022
Data, Tech & IP

Whatsapp challenges the EDPB’s Binding decision concerning its data-sharing practices: action published 

Official publication has been made of an action for annulment (T-709/21) brought by WhatsApp Ireland against the European Data Protection Board’s (EDPB) Binding Decision 1/2021 concerning the use of users’ personal data by WhatsApp in light of the General Data Protection Regulation (GDPR). 

In late 2019 Whatsapp informed European users about an upcoming change in its policies, in particular, the commencement of data-sharing with Facebook. The Irish Authority (‘LSA’) used the EDPB’s internal communication system to inform the other supervisory authorities of Whatsapp intended changes.

In this context, the EDPB was sent a request for an urgent binding decision under Article 66(2) of the GDPR to address a number of objections raised by various supervisory authorities. In its Binding Decision, the EDPB did not confirm the need to impose provisional measures against Facebook but given the high likelihood that data sharing is taking place, it requested the LSA to investigate certain key blind spots in WhatsApp’s data processing, including whether data is shared with Facebook, if the latter acts as processor or joint controller, and whether the legal basis for processing identified in the privacy policy is adequate (for more information read Analysis by Tiago Sérgio Cabral here).

In its action for annulment, Whatsapp argues, inter alia, that the EDPB exceeded its competence under Article 65 of GDPR, requested WhatsApp to provide unrequired information, applied the term ‘personal data’ excessively, violated the presumption of innocence by inappropriately shifting the burden of proof onto WhatsApp, disregarded WhatsApp’s right to be heard, and violated the principle of legal certainty by failing to acknowledge that its decision puts forward novel interpretations and applications of several provisions of the GDPR, with the consequence that the infringement was unpredictable.

Access the officially published action here



Your privacy is important for us

We use cookies to improve the user experience. Please review privacy preferences.

Accept all Settings

Check our privacy policy and cookies policy.