Identified Legal Basis 4: Compliance with a Legal Obligation What information has been provided? 364. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as WhatsApp refers to reliance on the legal basis set out in Article 6(1)(c) (compliance with a legal obligation). In this regard, the Legal Basis Notice provides the following information under this heading: “The other legal bases we rely on in certain instances when processing your data are: … For processing data when the law requires it, including, for example, if there is a valid legal request for certain data. See our Privacy Policy under Law and Protection for more information.” 365. The “Law And Protection” section of the Privacy Policy further provides as follows: “Law And Protection We collect, use, preserve, and share your information if we have a good-faith belief that it is reasonably necessary to: (a) respond pursuant to applicable law or regulations, to legal process, or to government requests; (b) enforce our Terms and any other applicable terms and policies, including for investigations of potential violations; (c) detect, investigate, prevent, and address fraud and other illegal activity, security, or technical issues; or (d) protect the rights, property, and safety of our users, WhatsApp, the Facebook Companies, or others, including to prevent death or imminent bodily harm.”
How has the information been provided? 366. The information has been provided by way of a short statement in the body of the Legal Basis Notice with a link to a short text in the “Law And Protection” section of the Privacy Policy, as referred to above.
Assessment of Decision-Maker Quality of information provided 367. I note that the “Law And Protection” section has already been incorporated, by way of a link, into the legitimate interests section. In these circumstances, its incorporation into the “legal obligations” section is a source of potential confusion for the user. I further note that, while the “Law And Protection” section identifies some processing operations (“collect”, “preserve” and “share”), it is not clear what processing operations might be covered by the umbrella term “use”. Further, and while I acknowledge that the processing that might be necessitated in the circumstances covered by this heading is largely dependent on the occurrence of certain events, the user should be provided with some indication as to what categories of personal data might be processed under this heading. 368. I note, in this regard, that there is information available elsewhere on the WhatsApp website that might assist the user to understand how and why his/her personal data might be processed under this heading. There are links within the Privacy Policy (embedded in text such as “end-to-end encrypted”) that links the user to WhatsApp’s “End-to-end encryption” FAQ145. There are a series of
145
Available at https://faq.whatsapp.com/en/general/28030015
106
