438. Further, the Investigator was concerned that the inclusion of a link that brings the user to information hosted on Facebook’s website risked confusing the data subject as to the identity of the data controller with regard to third country transfers. 439. Accordingly, the Investigator proposed a finding that the information provided, under this heading, did not provide the minimum level of information required by Article 13(1)(f). Further, the information that had been provided was insufficiently clear to satisfy the requirements of Article 12(1) of the GDPR. 440. WhatsApp rejected this proposed finding. It submitted179 that: “On a proper analysis, the drafting of [the “Our Global Operations”] section of WhatsApp’s Privacy Policy represents quite a meticulous implementation of the detailed requirements of this part of Article 13(1)”. 441. WhatsApp further submitted180 that: “The Draft Report takes the view that WhatsApp must be explicit in respect of each recipient and each country to which it transfers personal data. Not only is this not required by the GDPR … it is also impractical and would require a controller operating a service such as WhatsApp to continuously update its privacy notice in the (likely frequent) event it engaged a new service provider based in a different jurisdiction outside the EEA. There is simply no statutory basis for this interpretation of the GDPR and, in any event, such an approach would result in excessive and confusing information for users. … Moreover, the fact that WhatsApp relies on safeguards to transfer personal data of its EU users instead of relying entirely on derogations, and communicates this to its users, provides a significant level of protection. The further level of specificity described in the Draft Report is simply not a legal requirement.” 442. The Investigator was not swayed by WhatsApp’s submissions, in this regard, and confirmed her view, by way of Conclusion 11, that WhatsApp failed to discharge its obligations pursuant to Article 13(1)(f) in circumstances where it failed to provide the minimum level of information required.
Assessment of Decision-Maker: What information has been provided? 443. The “Our Global Operations” section of the Privacy Policy includes the following information: “Our Global Operations … Information controlled by WhatsApp Ireland will be transferred or transmitted to, or stored and processed, in the United States or other countries outside of where you live for the purposes as described in this Privacy Policy. … We utilize standard contract clauses approved by the European Commission, and may rely on the European Commission's adequacy decisions about certain countries, as applicable, for data transfers from the European Economic Area to the United States and other countries. ….”
179 180
The Inquiry Submissions, paragraph 13.2 The Inquiry Submissions, paragraph 13.3
124
