WhatsApp has signed public commitment not to share personal data with Facebook until data protection concerns are addressed, said Elizabeth Denham, the UK Information Commissioner.
Denham’s office has completed an investigation, which began in August 2016, into whether WhatsApp could legally share users’ data with Facebook in the way that they were planning. In 2014 Facebook acquired WhatsApp, which offers an instant messaging service for smartphones.
“People have a right to have their personal data kept safe, only used in ways that are properly explained to them, and for certain uses of their data, to which they expressly consent,” said Denham. “This is a requirement of the Data Protection Act.”
The investigation found that WhatsApp had not identified a lawful basis of processing for the sharing of personal data; failed to provide adequate fair processing information to users; and such sharing would involve the processing of personal data for a purpose that is incompatible with the purpose for which such data was obtained. If WhatsApp had shared the data it would have contravened the Act.
The company has signed an undertaking not to share personal data with Facebook until they can do so in compliance with the upcoming General Data Protection Regulation (GDPR), which comes into force in May this year.
WhatsApp has not incurred a financial penalty. “I reached the conclusion that an undertaking was the most effective regulatory tool for me to use, given the circumstances of the case,” said Denham. The company had assured the Commissioner that no UK user data has been shared with Facebook, apart from so-called ‘processing’ data which generally does not raise protection concerns.
“I compliment WhatsApp in signing this undertaking, which I believe will build trust amongst their many UK users,” added Denham. “I would also like to stress that signing an undertaking is not the end of story and I will closely monitor WhatsApp’s adherence to it.”