Data Protection Commissioner examining WhatsApp-Facebook plan

The Data Protection Commissioner in Ireland is examining the sharing of user information between WhatsApp and Facebook after authorities in Hamburg banned the practice for its 35 million users in Germany on foot of privacy concerns.

The data protection commissioner for the city of Hamburg earlier this week said it had banned Facebook from collecting and storing the data of users of its WhatsApp service after officials judged it breached data protection laws by sharing customer information.

Facebook was also told to delete all data, including phone numbers, already forwarded by WhatsApp. The company has said it will appeal against both orders.

WhatsApp, which was acquired by Facebook for $19 billion (€16.9 billion) two years ago, announced it would share information from its one billion-plus user base with its parent for the first time in August. It admitted the move would mean that user data such as phone numbers could be used for targeted advertisements.

Policy change

After being notified of the policy change, WhatsApp users were given just 30 days to opt in or out of the changes, or face not being able to access the app.

Facebook, which like many other tech companies has its European headquarters in Dublin, has reiterated that it recently introduced data encryption to WhatsApp so that user content cannot fall into the wrong hands.

It also insists that any information shared between the two entities is designed to ensure improved services for users.

As its European HQ is in Dublin, Facebook is regulated by the Irish Data Protection Commission, which said it was "continuing its inquiries into the revised privacy policy implemented by WhatsApp and Facebook in August ".

“The Data Protection Commission is focusing its attention on the type of information shared between WhatsApp and Facebook on foot of the revised policy, particularly in cases where consumers have exercised their right to opt out,” it added.

Hamburg commissioner

Facebook has reportedly questioned whether the Hamburg commissioner has the authority to impose a ban on the company given that it operates in Europe from Dublin and its actions are therefore governed by Irish law.

While there are 16 data protection authorities in Germany – one for each federal state – Facebook’s German activities are headquartered in Hamburg, thereby placing the company under the jurisdiction of the city’s regulator.

Commissioner for data protection and freedom of information for Hamburg Johannes Caspar noted that after Facebook acquired WhatsApp, both parties had made public assurances that they would not share data.

“The fact that this is now happening not only misleads users and the public, but also constitutes an infringement of national data protection law,” he said.