“more granularity is required to comply with Article 13(1)(c) GDPR in this regard. In particular, WhatsApp is of the view that the user is already provided with adequate information so that the user can identify which “safety and security” objectives will be grounded on vital interests … as it is evident that this will be engaged in circumstances where a life or physical integrity is at risk.” Nonetheless, WhatsApp intends to provide the user with some examples of the type of data that has been processed by reference to past processing, as suggested by the Commission.150” 384. As before, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the information provided by WhatsApp to users under this heading. I have already set out above the reasons why I consider the information provided to be insufficient, in terms of the quality of the information that has been provided. My concerns remain, in this regard, notwithstanding WhatsApp’s perspective on matters however I acknowledge that WhatsApp intends to provide the user with examples, as suggested.
Identified Legal Basis 6: Tasks carried out in the public interest What information has been provided? 385. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as WhatsApp refers to reliance on the legal basis set out in Article 6(1)(e) (tasks carried out in the public interest). In this regard, the Legal Basis Notice provides the following information under this heading: “The other legal bases we rely on in certain instances when processing your data are: … For undertaking research and to promote safety and security, as described in more detail in our Privacy Policy under How We Use Information, where this is necessary in the public interest as laid down by European Union law or Member State law to which we are subject.”
How has the information been provided? 386. The information has been provided by way of the statement set out above with a link that, when selected, brings the user back to the “How We Use Information” section of the Privacy Policy. While that section contains two further embedded links, the one relevant to this assessment brings the user to an “article” hosted on the Facebook website entitled “the Facebook Companies” (which contains further links to further relevant information).
Assessment of Decision-Maker Quality of information provided 387. I am unable to identify at any level, based on the information that has been provided in relation to this legal basis, what sort of processing operation will be grounded on this legal basis and what categories of personal data will be processed under this heading. Where WhatsApp intends to ground a processing operation on this legal basis, it should also identify the “European Union law or Member State law” giving rise to the obligation for WhatsApp to process data. 388. I further note that “the promotion of safety and security” has been included under the contractual necessity heading, the legitimate interests heading and the vital interests heading. If this is not an 150
The Preliminary Draft Submissions, paragraph 7.21
111
