c.
The text failed to identify the category of data subject that was covered by the term “you”. This left it unclear as to whether the sharing of data occurred in the context of users, or non-users or both.
d. Further, the diversion of the data subject to the Facebook website risked creating confusion in relation to the entity/entities covered by the term “we”. In other words, the data subject could interpret the term “we” as meaning WhatsApp, Facebook or any and all of the Facebook Companies. 528. WhatsApp rejected the Investigator’s proposed finding and submitted210 that: “The Draft Report seeks to give the impression that information on the relationship between WhatsApp and the Facebook Companies is opaque and difficult to discern from the Online Documents. The opposite is in fact the case. The Draft Report fails to mention that the fact WhatsApp may share information with other Facebook Companies is explained in the “Key Updates” summary page at the very top of the Online Documents. It also fails to mention that WhatsApp provides a suite of FAQs addressing a range of different issues relevant to WhatsApp’s relationship with other Facebook Companies (depending on what a particular user is interested in understanding), all of which are designed to maximize transparency around WhatsApp’s processing activities. Only one of these FAQs is referred to in the Draft Report – described as the “WhatsApp Website FAQ document”.” 529. WhatsApp further submitted that the Draft Report failed to have due regard to the clear statements that had been included in various pieces of text “as to what Facebook cannot do with WhatsApp user data”. 530. The Investigator was unconvinced by WhatsApp’s submissions and confirmed her view, by way of Conclusion 15, that WhatsApp was not compliant with the transparency requirements, as specifically set out in Articles 12(1), 13(1)(e) and 13(1)(f) of the GDPR in the context of the information provided, explaining how it works with the Facebook Companies.
The Decision-Making Stage 531. The issue for assessment is the extent to which WhatsApp complies with its transparency obligations, by providing meaningful information in relation to how it works with other Facebook companies. 532. In its Response to Investigator’s Questions, WhatsApp indicated that it provides information to users in relation to how it works with other Facebook Companies by way of the Privacy Policy and related pages (including the Legal Basis Notice), with particular reference to the “How We Work With Other Facebook Companies” section of the Privacy Policy and the linked FAQ entitled “How we work with the Facebook Companies211” (“the Facebook FAQ”). WhatsApp furnished a copy of the Facebook FAQ by way of Appendix 3 to its Response to Investigator’s Questions.
210 211
The Inquiry Submissions, paragraph 17.2 Available at https://faq.whatsapp.com/general/26000112/?eea=1 (the “Facebook FAQ”)
143
