Mervinskiy 437

420. WhatsApp rejected this proposed finding. It submitted173 that: “Under the “Information You and We Share” section of the Privacy Policy, WhatsApp separately identifies “third party service providers” as a category of recipients. WhatsApp details, in clear and plain language and in a concise manner, the types of processing activities that these service providers undertake for WhatsApp as well as giving assurances as to the contractual obligations on those providers. Examples ensure that users can understand how these companies provide services to and on behalf of WhatsApp, whilst avoiding technical or complex terms like data processor or data processing agreement. 421. The Investigator was unconvinced by WhatsApp’s submissions, in this regard, and confirmed her view, by way of Conclusion 10, that the information provided by WhatsApp failed to satisfy the requirements of Articles 13(1)(e) and 12(1) of the GDPR.

Assessment of Decision-Maker: What information has been provided? 422. The sections of the Privacy Policy identified by WhatsApp contain the following relevant information: “Information You And We Share … we share your information to help us operate, provide, improve, understand, customize, support, and market our Services.  …  Businesses On WhatsApp. We help businesses who use WhatsApp measure the effectiveness and distribution of their services and messages, and understand how people interact with them on our Services.  Third-Party Service Providers. We work with third-party service providers and the Facebook Companies to help us operate, provide, improve, understand, customize, support, and market our Services. ….  ….“ 423. Also: “How We Work With Other Facebook Companies We are part of the Facebook Companies. As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the Facebook Companies. …. Learn More about how WhatsApp works with the Facebook Companies.” 424. And, finally: “Assignment, Change of Control, And Transfer All of our rights and obligations under our Privacy Policy are freely assignable by us to any of our affiliates, in connection with a merger, acquisition, restructuring, or sale of assets, or by operation of law or otherwise, and we may transfer your information to any of our affiliates, successor entities, or new owner.”

Mervinskiy 437

Articles inside

The Decision-Making Stage

Article 83(5) and the applicable fining “cap”

Decision: Whether to impose an administrative fine and, if so, the amount of the fine

Appendix C – Terms of Order to bring processing operations into compliance, made pursuant to Article 58(2)(d

Summary of Corrective Powers to be Exercised

Article 83(2)(k): any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement

Assessment: Article 13(2)(a) – Retention Criteria/Retention Periods

Assessment: Article 13(2)(b) – the existence of the data subject rights

Assessment of Decision-Maker: What information has been provided?

Identified Legal Basis 5: The vital interests of the data subject or those of another person

Assessment of Decision-Maker: What information has been provided?

Assessment: Article 13(1)(f) – Transfers of personal data to a third country

Assessment of Decision-Maker: What information has been provided?

Identified Legal Basis 6: Tasks carried out in the public interest

Identified Legal Basis 1: Contractual Necessity

Identified Legal Basis 2: Consent

Identified Legal Basis 4: Compliance with a Legal Obligation

Identified Legal Basis 3: Legitimate Interests

Preliminary Issue: What information must be provided pursuant to Article 13(1)(c)?

Assessment: Application of the Proposed Approach to Article 13(1)(c

Review of the Materials being relied upon by WhatsApp

Assessment: Article 13(1)(c) – the purposes of the processing for which the personal data are intended as well as the legal basis for the processing

Assessment of Decision-Maker: What information has been provided?

Methodology for Part 2: Assessment and Questions for Determination

Relevant Provisions

Assessment: Article 13(1)(a) – the identity and contact details of the controller