The French Data Protection Authority CNIL has directed social messaging platform WhatsApp to stop sharing users data with its parent company Facebook. WhatsApp was acquired by Facebook in 2014.
The independent French administrative regulatory body states that the data of its users are now transmitted to FACEBOOK Inc. for advertising targeting, security and the evaluation and improvement of services (“business intelligence”).
It is also found that information about users such as their phone number and information about their usage habits of the application are also shared.
According to CNIL, WhatsApp is not authorized to share its data without getting consent from users as required by the French and European Union data protection laws.
The G29 (group of European CNILs) requested explanations from WHATSAPP about the processing performed for this data transmission, while requesting that it be discontinued regarding advertising targeting. The G29 has also tasked its sub-group in charge of cooperation in investigations and sanctions (“enforcement subgroup”), in particular to coordinate the actions of authorities wishing to conduct investigations.
Failure to cooperate with the Commission
The CNIL services have repeatedly asked WHATSAPP to provide them with a sample of French user data transmitted to FACEBOOK Inc. The company has indicated that it is unable to provide this information to the extent that, being United States, it considers itself subject only to the legislation of that country.
The President of the CNIL has therefore decided to give notice to the WHATSAPP company to comply with the law within one month.
The President and the two vice-presidents of the CNIL have decided to publish this notice to ensure the highest level of transparency on the massive data transmission from a large number of users of WHATSAPP to FACEBOOK Inc. and thus alert to the need to put people in a position to maintain control of their data.
This choice also results from the fact that the company WHATSAPP has not cooperated sufficiently with the CNIL, which did not allow to fully control the conformity of this data transmission, even though it contributes to the increase of the considerable amount of data. information available to FACEBOOK Inc., including non-users of its social network.
The CNIL reminds that this formal notice is not a penalty. No follow-up will be given to this procedure if the company complies with the law within the time limit. In this case, the closure of the procedure will also be publicized.
If the company does not comply with this formal notice within the time limit, the President may appoint a rapporteur who will propose if necessary to the restricted training of the CNIL, responsible for punishing breaches of the law, to impose a penalty.