“The Privacy Policy identifies WhatsApp Ireland as the controller for users of the Service in the EU. Users can contact [WhatsApp] via a link provided in the Privacy Policy or alternatively using the details as provided in the ‘Contact Information’ section of the Privacy Policy.”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s Conclusion 236. The Investigator’s views, in relation to the extent to which WhatsApp has complied with Article 13(1)(a), are set out by reference to Proposed Finding 4 of the Draft Report. 237. The Investigator proposed a finding that WhatsApp failed to clearly identify the data controller for the Service on the basis of inconsistencies between the language used in the Terms of Service and the language used in the Privacy Policy. Such inconsistencies, in the view of the Investigator, rendered the information provided “unclear and unintelligible”, contrary to Article 12(1). 238. WhatsApp disagreed with the Investigator’s assessment. It submitted113 that the proposed finding ignored “the clear and unequivocal language in the Privacy Policy” and the fact that the Privacy Policy is the “primary information and transparency document in respect of WhatsApp’s data processing”. 239. The Investigator, however, was not swayed by WhatsApp’s submissions and confirmed, by way of Conclusion 4, her view that the information provided by WhatsApp, in this regard, was “unclear and therefore contrary to Article 12(1) of the GDPR.”
Assessment of Decision-Maker: What information has been provided? Re: the requirement to provide the identity of the controller 240. The second paragraph of the Privacy Policy states that: “If you live in a country in the European Economic Area (which includes the European Union), and any other included country or territory (collectively referred to as the European Region), your Services are provided by WhatsApp Ireland Limited (“WhatsApp Ireland”), which is also the data controller responsible for your information when you use our Services.”
Re: the requirement to provide the contact details of the controller 241. The “Contact Information” section of the Privacy Policy includes the following information: “If You Are In The European Region … If you have questions about our Privacy Policy, please contact us or write us here: WhatsApp Ireland Limited Attn: Privacy Policy 4 Grand Canal Square Grand Canal Harbour Dublin 2 Ireland”
113
The Inquiry Submissions, paragraphs 6.1 and 6.2
76
