382 NEWSLETTER 2021 A Groundbreaking Whatsapp Decision by the Irish Supervisory Authority* Defne Pırıldar Introduction On 2 September 2021, the Irish Data Protection Commission, the supervisory authority in Ireland (“IE SA”), announced its decision (“National Decision”) regarding the investigation (“Investigation”) it had performed to establish whether WhatsApp Ireland Ltd (“WhatsApp IE”) had violated its transparency obligations set under General Data Protection Regulation (“GDPR”).1 As the investigation was of a cross-border nature, the IE SA carried the investigation as the lead supervisory authority and rendered its final and binding decision after the dispute resolution decision of the European Data Protection Board (“EDPB”) dated 28 July 2021 (“EDPB Decision”). Soon after, the EDPB itself announced the decision in a press release on 2 September 2021. This press release also elaborated on the material recommendations in the EDPB Decision and the findings of the IE SA in its Draft Decision.2 Considering the binding recommendations under the EDPB Decision, the IE SA increased the fine that was proposed with its draft decision and imposed a fine of €225 million on WhatsApp IE. The National Decision, as well as the EDPB Decision, deserve careful study as it is the second highest administrative fine imposed under the GDPR by a European authority. This Newsletter will focus on the details of the investigation and the assessments of the EDPB. * Article of November, 2021 1 https://dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-whatsapp-inquiry. (Access date: 13.11.2021). 2 https://edpb.europa.eu/news/news/2021/edpb-requests-irish-sa-amends-whatsapp-decision-clarifications-transparency-and_en. (Access date: 13.11.2021).
RkJQdWJsaXNoZXIy MjUzNjE=