The encyclopedia · Legal & Compliance · Legal decision · 2021–2023
WhatsApp fined €225M for not telling users how their data is shared
Ireland's watchdog fined WhatsApp — users were never told how their data moved between the Facebook companies — and the EU's board made the penalty steeper.
WhatsApp · 2021-09-02
What happened
In September 2021 Ireland's Data Protection Commission fined WhatsApp €225 million — its first major GDPR sanction and at the time the second-largest penalty in the regulation's short history.
The case was about transparency, not a hack. The DPC found WhatsApp had not told people clearly enough how their data was shared with the other Facebook companies, and had not established a sufficient legal basis for that sharing.
The fine started life far smaller. The European Data Protection Board, which reviews the draft decisions of lead regulators, ordered the DPC to raise the penalty more than fourfold from an initial €50 million figure, a signal of how severely the EU's collective regulator thought transparency lapses should be priced.
Why it happened
- Writing the transparency notice so it obscured the real data flows treated a fair-information duty as paperwork rather than as something a user could actually act on.
- Relying on a thin basis for data-sharing and defending it under review left the regulator pricing both a transparency breach and a legal-basis breach.
- A lead regulator's draft that the EDPB had to push upward showed the penalty was calibrated to what the company argued, not to what the board read the law to demand.
The lesson
Transparency rules are met by what a user can actually learn, not by what a notice technically discloses — and a legal basis a regulator rejects becomes part of the fine.
Sources
- DPC announces its decision in the WhatsApp inquiry — Data Protection Commission
- Decision concerning WhatsApp Ireland Limited — Data Protection Commission
- WhatsApp to appeal €225m GDPR fine — RTÉ
spotted an error? The club wants to know.
More like this
Amazon's €746M GDPR record fine was scrapped on a technicality
AliExpress got a €550M EU fine — the DSA's first big test landed on Alibaba
Italy fines Replika's maker €5 million over GDPR and children's data
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.