341. WhatsApp also submitted that the proposed finding “conflicts with suggestions given by the Commission as part of its pre-GDPR engagement with WhatsApp, as evidenced in an email dated 11 April 2018, in which the Commission confirmed that the use of “technological design” and “hyperlinks to specific portions of the Terms/Privacy Policy” in the Legal Basis Notice was recommended139.” 342. It is clear that WhatsApp and I fundamentally disagree as to my assessment of the information provided by WhatsApp to users under this heading. I have already set out above the reasons why I consider the information provided to be insufficient, in terms of quality and the manner of delivery. My assessment, in this regard, already takes account of the matters raised by WhatsApp in the Preliminary Draft Submissions and my concerns remain, notwithstanding WhatsApp’s perspective on matters. Further, I do not agree with WhatsApp’s submission concerning “the benefit to users of more generally providing a range of easily accessible tools, settings and measures” or “the ease with which the user can navigate from the Privacy Policy to the linked Legal Basis Notice and to the Terms of Service (and back) …”. Such matters are only beneficial to the user if the user has been provided with the information that he/she is entitled to receive (which I do not consider to be the case here). Finally, my assessment of WhatsApp’s submissions concerning its pre-GDPR engagement with the Commission’s Consultation Unit has already been considered as part of my assessment of WhatsApp’s Submissions of General Application, above.
Identified Legal Basis 2: Consent What information has been provided? 343. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as WhatsApp refers to reliance on the legal basis set out in Article 6(1)(a) (consent). With regard to WhatsApp’s reliance on consent, the Legal Basis Notice provides that: “The other legal bases we rely on in certain instances when processing your data are: … Your Consent For collecting and using information you allow us to receive through the device-based settings when you enable them (such as access to your GPS location, camera, or photos), so we can provide the features and services described when you enable the settings.”
How has the information been provided? 344. The information set out above has been provided in a clear and concise manner.
Assessment of Decision-Maker 345. While the manner in which the information has been made available to the user is clear and concise, the quality of the information provided is insufficient in that it fails to identify the processing operations that will be grounded upon the user’s consent. It further fails to identify the categories of data that will be processed for the processing operations that will be grounded upon the user’s consent. I note, in this regard, that the information provided specifically references the “collection” and “use” of information that the user “allows” WhatsApp to receive through the device-based settings, such as access to the user’s GPS location, camera or photos.
139
The Preliminary Draft Submissions, paragraph 7.4
100
