French privacy watchdog gives WhatsApp month to get data transfers in order

French privacy regulator Cnil has given WhatsApp one month to allow its data transfers to parent company Facebook to proceed according to the law. Only if the company does not comply with the request can the regulator impose sanctions.

The watchdog writes in a message on its website that it has conducted an investigation, which shows that Facebook has never processed the personal data of 10 million French people for the purpose of targeted advertising, but that the company has still violated French law. For example, there would be no valid legal reason for processing the data. According to the watchdog, this should only happen on the basis of permission, but that is not happening at the moment because that permission is not specific enough and is not given freely.

Moreover, the decision to issue an ultimatum to WhatsApp was prompted by the fact that the company would not fully cooperate with the regulator. The organization asked WhatsApp for a sample of the data of French people it shares with Facebook. The company refused, because that data is located in the US, which would make it subject to US law. The watchdog further wrote that the current statement to WhatsApp was made public to “achieve the highest level of transparency and draw attention to the need for people to control their data.”

WhatsApp announced in August last year that it would share data with its parent company Facebook. The WhatsApp company stopped sharing data for advertising and friend requests about a year ago, after the joint body of European privacy regulators, the Article 29 Working Group, first requested it. That working group recently said that data sharing cannot continue because WhatsApp has not yet taken satisfactory measures in the meantime.