WhatsApp Agrees Not To Share Data With Facebook… For Now

The Information Commissioners Office (ICO) has completed its two-year investigation into the data-sharing practices of WhatsApp.

The popular messaging app has signed a public pledge not to share any user’s data with Facebook after the ICO ruled that doing so would be illegal under the data protection act and before the implementation of the General Data Protection Regulation (GDPR) in May this year.

The ICO ruling comes after a difficult few years for the messaging service, after concerns were first raised when Facebook acquired WhatsApp in 2014.

Data sharing

The whole furore began in in August 2016 when Facebook controversially decided to update WhatsApp’s terms of service and privacy policy to include sharing data with the social network.

This change prompted outrage among WhatsApp users and European regulators.

Matters were not helped by the fact that WhatsApp founder Jan Koum had denied at the time of the acquisition that WhatsApp would have to follow Facebook’s privacy policies.

Indeed, such was the controversy that Facebook had to suspend in November 2016 data sharing between its social network and WhatsApp across the European Union.

That same month WhatsApp also suspended such data sharing activity in the UK.

ICO investigation

But now WhatsApp has signed an agreement with the ICO not to share data with Facebook until after the GDPR is implemented on 25 May.

“My office has just completed an investigation, which commenced in August 2016, into whether WhatsApp could legally share users’ data with Facebook in the manner they were considering,” blogged Information Commissioner Elizabeth Denham.

She said the ICO investigation had found that WhatsApp had not identified a lawful basis of processing for any such sharing of personal data. It also failed to provide adequate fair processing information to users in relation to any such sharing of personal data

The ICO also concluded that if WhatsApp had shared the data, they would have been in contravention of the first and second data protection principles of the Data Protection Act.

“I am pleased to state that WhatsApp has now signed an ‘undertaking’ wherein they have given a public commitment not to share personal data with Facebook until they can do so in compliance with the upcoming General Data Protection Regulation (GDPR), which comes into force in May this year,” wrote the Commissioner.

“I reached the conclusion that an undertaking was the most effective regulatory tool for me to use, given the circumstances of the case,” she wrote. “I therefore compliment WhatsApp in signing this undertaking, which I believe will build trust amongst their many UK users. I would also like to stress that signing an undertaking is not the end of story and I will closely monitor WhatsApp’s adherence to it.”

European concerns

Facebook was fined 110 million euros (£93.8m) in May 2017 because the EU felt that the social network giant had provided misleading information during EU scrutiny of the deal.

And in December Germany’s competition regulator warned Facebook that its collection of data on users and transfer of that information to the US may be “abusive” due to the social network’s dominant position in the country.

In the same month France’s data protection agency, the CNIL, said it had determined WhatsApp’s transmission of user data to parent company Facebook was illegal under French law and gave the companies one month to bring themselves into compliance.

Quiz: Can you protect your privacy online?