Facebook Inc. is once again feeling the weight of European privacy regulations, as a German court today upheld a ruling that forbids the social network from transferring WhatsApp user data without consent.

Johannes Caspar, the Hamburg Commissioner for Data Protection, announced today that the court has rejected Facebook’s appeal against a ban on transferring WhatsApp data. In a statement, Caspar said that when Facebook acquired WhatsApp in 2014, the social media giant promised that user data would not be exchanged without permission, a promise he says Facebook broke last year when it quietly changed WhatsApp’s privacy policy.

Caspar argued that Facebook and WhatsApp are two independent companies that process user data separately, and therefore that data cannot be transferred from one service to the other without express user consent. He also said that Facebook has not provided adequate proof that the data transfer is necessary.

“After this decision there will still be no mass exchange of the data of domestic users between WhatsApp and Facebook,” Caspar said. “This is a good news for the millions of people who use WhatsApp’s messenger service in Germany every day. They are not defenseless.”

Facebook (Chief Executive Mark Zuckerberg, pictured) has yet to comment on the court’s decision, but the company will likely continue to fight against the ruling.

The concern over data sharing with WhatsApp is only one of many privacy battles Facebook has fought in the European Union over the last few years. In 2015, Austrian privacy activist Max Schrems filed a class action lawsuit against Facebook, claiming that the social media giant misuses user data. That case finally came to a close last month, but the court decided to reserve judgment until a later date. A Belgian privacy watchdog has also previously accused Facebook of “trampling” on EU privacy laws.

Facebook is not the only major company struggling with privacy regulations in the EU. In a recent survey by Veritas Technologies LLC., nearly 20 percent of executives surveyed said that the EU’s recently adopted General Data Protection Regulation could drive them out of business.

The GDPR places significant restrictions on how businesses can store and transfer personal data, which the EU defines as “anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information or a computer’s IP address.” Companies that violate the GDPR’s rules could carry steep fines of up to $21 million or 4 percent of their annual revenue, whichever is higher.

Photo: Facebook