385 PERSONAL DATA PROTECTION Article 14 and therefore, decided on a fine from a range between €30 million and €50 million.7 The analysis done by the SA IE received diverse objections by the CSAs. While assessing the objections, the EDPB highlighted the comment raised by the Polish supervisory authority that “the finding that the Lossy Hashing procedure does not guarantee the anonymization of data would lead to a different conclusion as regards both the scope of the obligations under Articles 12 and 14 GDPR and the corrective measures”.8 For this reason, the EDPB concluded that there was a need to amend the Draft Decision, since it posed a risk that non-user data subjects might not be able to enforce their rights under the GDPR and requested IE SA to include a finding of an infringement of Article 13/1 (d).9 Additionally, the EDPB pointed out further infringements under Article 5/1 (a) of the GDPR. The EDPB stated that the principle of transparency is not limited to the obligations established under Articles 12, 13, and 14 of the GDPR, and suggested that transparency is an overarching principle which both reinforces and stems from other principles.10 In the view of the (i) gravity, (ii) “overarching nature” and (iii) effect of the infringements, the EDPB concluded that the infringement of transparency obligations also amounted to a breach of Article 5/1 (a).11 In other words, the EDPB concluded that WhatsApp IE violated its obligation to process personal data lawfully, fairly and in a transparent manner. The Draft Decision by the SA IE also included a corrective measure which obliged WhatsApp IE to bring its operations into compliance within six months pursuant to Article 58/2 (d) of the GDPR. Moreover, the SA IE proposed seven actions to be applied by WhatsApp IE to provide information in compliance with Articles 12, 13 and 14 of the GDPR.12 Given the organization, size and means of WhatsApp IE, the EDPB found that it was of primary importance to 7 EDPB Decision, para. 68. 8 EDPB Decision, para. 136. 9 EDPB Decision, para. 66. 10 EDPB Decision, para 192. 11 EDPB Decision, para. 201. 12 EDPB Decision, para. 241.
RkJQdWJsaXNoZXIy MjUzNjE=