Facebook has received an administrative order requiring it to stop automatically collecting and storing data on German WhatsApp users.
On 27 September, the Hamburg Commissioner for Data Protection and Freedom of Information aired its grievances in a press release (PDF).
After Facebook first acquired WhatsApp, the statement explains, both companies made public assurances that they would not share data between them.
WhatsApp ostensibly walked those assurances back after it began sharing data pertaining to its German users with Facebook, something which the city of Hamburg data protection commissioner finds unacceptable:
“The fact that this is now happening is not only a misleading of their users and the public, but also constitutes an infringement of national data protection law. Such an exchange is only admissible if both companies, the one that provides the data (WhatsApp) as well as the receiving company (Facebook) have established a legal basis for doing so. Facebook, however, neither has obtained an effective approval from the WhatsApp users, nor does a legal basis for the data reception exist. It is clear that Facebook must respect German data protection law after the ECJ confirmed in its ruling from July, that national data protection laws are applicable if a company processes data in connection with a national subsidiary.”
Hamburg’s data protection commissioner says Facebook must stop collecting and storing information on WhatsApp’s roughly 35 million German users. It’s also demanded that the social networking company delete any and all information pertaining to those users it’s already received.
That’s not to say Facebook can’t collect information about German WhatsApp users. But as the Hamburg data protection commissioner Johannes Caspar notes, users should have a choice:
“It has to be their decision, whether they want to connect their account with Facebook. Therefore, Facebook has to ask for their permission in advance. This has not happened.”
According to The New York Times, Facebook said it had already complied with Europe’s privacy rules and is willing to work with Germany to address these data protection concerns.
News of this administrative order follows a few months after WhatsApp added full end-to-end encryption to all communication on its service.