Samuel Gibbs

The Information Commissioner’s Office (ICO), the United Kingdom’s data protection watchdog, has concluded that WhatsApp’s sharing of user data with its parent company Facebook would have been illegal. The messaging app was forced to pause sharing of personal data with Facebook in November 2016, after the ICO said it had cause for concern. The ICO opened a full investigation into the matter in August that year.

Messaging services such as WhatsApp, Facebook Messenger and Gmail will face tough new rules on the tracking of users under a revision to the ePrivacy Directive proposed by the European Commission.

The new legislation seeks to reinforce the right to privacy and control of data for European citizens, with messaging, email and voice services – such as those provided by Facebook, Google and Microsoft – forced to guarantee the confidentiality of conversations and metadata around the time, place and other factors of those conversations. Listening to, tapping, intercepting, scanning or the storing of communications will not be allowed without the consent of the user, unless it is critical for billing or other purposes. Companies will have to ask for the explicit consent of users before being able to use their data for advertising purposes, which most use to fund services provided for free to end-users.

Andrus Ansip, vice-president for the digital single market said: “Our proposals will deliver the trust in the Digital Single Market that people expect. I want to ensure confidentiality of electronic communications and privacy. Our draft ePrivacy Regulation strikes the right balance: it provides a high level of protection for consumers, while allowing businesses to innovate.”

The European Commission (EC) has filed charges against Facebook for providing “misleading” information in the run-up to the social network’s acquisition of messaging service WhatsApp after its data-sharing change in August.

The charges will not have an affect on the approval of the $22 billion merger and is being treated completely separately to other European cases against Facebook, but could lead to Facebook being fined up to 1% of its global turnover in 2014 when the merger was approved, which was greater than $10 billion for the first time. The European competition commissioner, Margrethe Vestager, said, “Our timely and effective review of mergers depends on the accuracy of the information provided by the companies involved. In this specific case, the commission’s preliminary view is that Facebook gave us incorrect or misleading information during the investigation into its acquisition of WhatsApp. Facebook now has the opportunity to respond.” The commission said that Facebook informed regulators that it would not be able to perform automated matching between user-held Facebook accounts and WhatsApp accounts. However, Facebook’s privacy policy change for WhatsApp in August, for which the EC was notified in January, specifically enabled automated matching and data sharing after technical changes, including one for Apple and its iOS, allowed the matching of the majority of accounts not using a phone number with Facebook.''

The German data protection agency has ordered Facebook to stop collecting user data from its WhatsApp messenger app and delete any data it has already received. The social network announced in August that it would begin sharing data from its 1 billion-plus user base, including phone numbers, from WhatsApp users with Facebook for the purpose of targeted ads. It gave users the option of opting out of the data being used for advertising purposes, but did not allow them to opt out of the data sharing between WhatsApp and Facebook.

Hamburg’s Commissioner for Data Protection and Freedom of Information Johannes Caspar ruled that Facebook “neither has obtained an effective approval from the WhatsApp users, nor does a legal basis for the data reception exist”. “It has to be [the users’] decision whether they want to connect their account with Facebook. Facebook has to ask for their permission in advance.” Caspar also recalled that in the wake of Facebook’s 2014 acquisition of WhatsApp it had promised that they would not share user data.