Assessment: Article 13(1)(c) – the purposes of the processing for which the personal data are intended as well as the legal basis for the processing Required Information and WhatsApp’s Response to Investigator’s Questions 257. Article 13(1)(c) requires a data controller to provide the data subject with “the purposes of the processing for which the personal data are intended as well as the legal basis for the processing.” 258. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 4, that: “[WhatsApp] identifies the purposes of processing personal data and the legal bases for such processing in the Privacy Policy and the ‘How We Process Your Information’ notice …”
The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s Conclusion 259. The Investigator set out her views on the extent to which WhatsApp complied with its obligations under this heading by reference to Proposed Findings 5, 6, 7 and 9. 260. By reference to Proposed Finding 5, the Investigator expressed the view that the information provided in the “Our Legal Bases for Processing Information” section of the Privacy Policy was insufficient to demonstrate WhatsApp’s compliance with Article 13(1)(c) “as a first layer of information”. In addition, the Investigator expressed the view that: a. The information provided by the data controller, pursuant to Article 13(1)(c), “should link the processing activity and the legal basis relied on by the data controller”. The Investigator was of the view that this approach was consistent with the wording of Article 13(1)(c) and the views of the Working Party, as set out in the Transparency Guidelines. b. The Investigator was further of the view that the information should be provided by reference to a processing “operation” or “set of operations”, in accordance with the definition of “processing” set out in Article 4(2) and the provisions of Recital 60. 261. WhatsApp disagreed with the Investigator’s views, in this regard. It submitted that the GDPR does not require the precise legal bases being relied upon to be set out in the first layer of information114. WhatsApp further submitted115 that the GDPR “does not require the separate disclosure of the legal basis for each and every processing operation.” 262. The Investigator was unconvinced by WhatsApp’s submissions and confirmed, firstly, that she remained of the view that references to “processing” should be understood as being references to a processing “operation” or “set of operations”. By reference to that approach, the Investigator confirmed her view (by way of Conclusion 5) that the information provided under the sub-heading “Our Legal Bases for Processing Information” was insufficient to demonstrate WhatsApp’s compliance with Article 13(1)(c) of the GPDR, as a first layer of information.
114 115
The Inquiry Submissions, paragraph 7.3 The Inquiry Submissions, paragraph 7.7
79
