WhatsApp Issued GDPR Fine of €225m in Ireland
Ireland’s Data Information Officer fined WhatsApp €225M for breaching several privacy regulations. In the history of the GDPR, this is the second-largest fine they’ve issued. It’s also the largest ever issued by the Irish Data Protection Commission.
In 2018, WhatsApp was investigated for transparency problems regarding the information it provides users. It wasn’t clear enough whether the company adequately informed its users about the data processing. Ever since, WhatsApp has changed its Privacy Policy several times.
A company spokesperson said that “WhatsApp is committed to providing a secure and private service.”
He further said that “We have worked to ensure the information we provide is transparent and comprehensive and will continue to do so. We disagree with today’s decision regarding the transparency we provided to people in 2018, and the penalties are entirely disproportionate.”
The fine is so large this time because GDPR technically allows companies to be fined up to 4% of their global turnover.
Initial Disagreement
When the Irish DPC sent the decision on the fine to other data authorities, many did not agree with this ruling. After an extensive analysis of the circumstances and context, eight countries objected to the fine, including France, Italy, and Germany.
Some countries were in disagreement about the specific GDPR articles WhatsApp had broken. Others had something to say about how the Irish DPC calculated the fine.
Eventually, the European Data Protection Board informed the Irish DPC to “reassess” the proposed fine of €30-50m and think twice about “setting out a higher fine amount.”
Still, the Irish DPA formally reprimanded WhatsApp and demanded that it “bring its processing into compliance.” Max Schrems, a privacy campaigner, thinks the decision is correct, yet he also added that this situation “shows how the DPC is still extremely dysfunctional.”
He added that “The DPC gets about 10,000 complaints per year since 2018 – and this is the first major fine,” and that “in the Irish court system, this will mean that we will see years before any fine is paid.”
WhatsApp has already planned an appeal against this decision by the Irish DPC. In the history of the GDPR, only Amazon received a higher fine (€746m) for failing to comply with data-processing laws. Amazon, too, staunchly defends its innocence.
You can check out all publicly known GDPR fines by using our linked GDPR fines tracker.
Our Mission
We believe security online security matters and its our mission to make it a safer place.
