384 NEWSLETTER 2021 Following its assessment, the EDPB was of the opinion that the IE SA should amend its Draft Decision regarding the infringement of transparency obligations, the calculation of the fine, and the corrective measures. Based on the EDPB’s instructions to reassess and amend, the IE SA imposed a fine of €225 million on WhatsApp IE, as noted above. The IE AS also decided to exercise a reprimand pursuant to Article 58/2 (b) and issued an order for WhatsApp IE to bring its processing into compliance.4 Evaluation by the EDPB With its Draft Decision, the IE SA concluded that WhatsApp IE had breached its transparency obligations and had failed to comply with Articles 12, 13 and 14 of the GDPR. First, The EDPB noted that the SA IE made a finding of non-compliance with Article 13/1 (c) but did not find an infringement of Article 13/1 (d) of the GDPR. In this respect, the EDPB agreed with the objections which suggested that in order for data subjects to properly exercise their rights under the GDPR, they needed specific information about what legitimate interests were related to each processing operation, and which entity pursued each legitimate interest.5 The EDPB concluded that the Legal Basis Notice issued by WhatsApp IE did not contain specific information regarding the processing operations involved and therefore lacked clarity and intelligibility.6 Another material finding by the SA IE concerned the “Contact Feature” which allowed WhatsApp IE to process the phone numbers in the address books of the users who enabled the feature. The EDPB noted that WhatsApp IE could also collect data of non-users with the Contact Feature and examined the Lossy Hashing procedure used for the anonymization of personal data. In its Draft Decision, the SA IE concluded that the result did not constitute personal data when assessing the Lossy Hashing procedure. Despite this assessment, the SA IE concluded that WhatsApp IE failed to comply with its obligation under 4 National Decision, para. 888. https://edpb.europa.eu/system/files/2021-09/dpc_ final_decision_redacted_for_issue_to_edpb_01-09-21_en.pdf. (Access date: 13.11.2021). 5 EDPB Decision, para. 57-9. 6 EDPB Decision, para. 60-6.
RkJQdWJsaXNoZXIy MjUzNjE=