France’s data privacy agency CNIL has ordered WhatsApp to stop sharing data with its owner Facebook, the Verge reported, saying users never consented to sharing data for business intelligence or targeted advertising functions when Facebook disclosed the collection last year.
In a blog post, CNIL explained that while it agreed it was reasonable for Facebook to collect WhatsApp user data for security reasons, the other purposes were not justified “on the legal basis required by the Data Protection Act for any processing.” CNIL took particular issue with the way the data collection program was rolled out, arguing that Facebook did not accurately explain to users why their data was being collected and that users had no ability to opt out if they wanted to remain on WhatsApp. The agency gave Facebook 30 days to comply.
The agency wrote in its statement that it was disclosing the decision because of the “massive data transfer from WhatsApp to Facebook Inc. and thus to alert to the need for individuals concerned to keep their data under control.” CNIL added that it had “repeatedly asked WhatsApp to provide a sample of the French users’ data transferred to Facebook,” but Facebook had refused under the dubious legal reasoning that as a U.S. company it is not subject to French law.
If Facebook doesn’t cease collecting WhatsApp data, CNIL said, it will pursue further action including appointing an investigator who could recommend fines.
As the Verge noted, the German and U.K. governments issued similar orders last year, while the European Union fined Facebook €110 million in May 2017 for allegedly lying about whether it had the technical ability or plans to link WhatsApp accounts to its own data pools. According to Bloomberg, Facebook may soon face further trouble in Germany when a government antitrust probe into whether it has abused its market position concludes.
In the U.S., which has a far more laissez-faire approach to consumer data protection laws beyond a few areas like credit and medical histories, this kind of enforcement remains basically unthinkable. [The Verge]