Ireland’s privacy regulator today issued a fine of 225 million euros, or about $267 million, to Facebook Inc.’s WhatsApp unit for failing to provide users with sufficient information on how it collects and processes their data.

Officials have also ordered WhatsApp to take steps to more transparently disclose its data collection and processing practices.

The $267 million penalty represents one of the largest privacy fines issued to date in the European Union. Ireland’s privacy regulator, the Irish Data Protection Commission, is currently pursuing more than 20 other investigations into the practices of leading tech firms that could potentially lead to additional fines down the line.

WhatsApp and its messaging service became part of Facebook through a $19.3 billion acquisition in 2014. Two years later, the European Union implemented the General Data Protection Regulation, or GDPR as the law is more commonly known, which introduced a host of new privacy rules limiting how companies may process user data. The Irish Data Protection Commission issued the $267 million fine to WhatsApp because it found that the service has failed to meet the privacy requirements set forth in GDPR.

In particular, the regulator determined that WhatsApp breached “GDPR transparency obligations with regard to the provision of information and the transparency of that information to both users and non-users of WhatsApp’s service.” Officials found, among others, that WhatsApp didn’t properly inform users about the way it had shared their personal data with parent company Facebook.

The ruling is the fruit of an investigation that began in 2018. The probe was led by the Irish Data Protection Commission because Facebook’s EU headquarters is based in Ireland. 

After determining that WhatsApp breached GDPR, officials at first proposed a fine of up to 50 million euros. However, a number of privacy regulators from other EU countries argued that the penalty is too low.

The regulators didn’t reach a consensus on the matter, which led the Irish Data Protection Commission to trigger a dispute resolution mechanism built into GDPR for such scenarios. The move resulted in WhatsApp’s GPR breaches going before a board comprising all the EU’s privacy regulators. At the end of July, the board determined that WhatsApp should be given a bigger fine than the up to 50 million euro ruling proposed originally, and the Irish Data Protection Commission subsequently began calculating a higher penalty.

The $267 million fine issued today is the result of the regulatory process. However, the matter isn’t yet concluded: WhatsApp has hinted that it will appeal. 

“We disagree with the decision today regarding the transparency we provided to people in 2018 and the penalties are entirely disproportionate,” WhatsApp told the Wall Street Journal in a statement. The Facebook unit “has worked to ensure the information we provide is transparent and comprehensive,” the statement continued.

Facebook can reportedly submit its appeal not only in Ireland but also directly to the EU’s top court, the European Court of Justice. That’s because the fine was issued as a result of a decision by a board representing all EU privacy regulators. 

“The fine will undoubtedly be appealed by Facebook and will likely be significantly reduced in court as we already witnessed with other major cases,” commented Ilia Kolochenko, the founder and chief executive officer of cybersecurity company ImmuniWeb. “The judicial process to get a final and enforceable decision will likely take several years. It’s very unlikely any Europeans, whose privacy rights were allegedly violated by WhatsApp, will get any compensation.”

In the U.S., Facebook is currently facing an antitrust lawsuit from the Federal Trade Commission that also involves WhatsApp. The lawsuit charges that Facebook’s acquisition of WhatsApp, as well as its earlier purchase of Instagram, were designed to “cement its monopoly by severely hampering the ability of rivals and would-be rivals to compete.”

Photo: Christoph Scholz/Flickr