272. By reference to Proposed Finding 9, the Investigator set out her views in relation to the information that had been provided concerning WhatsApp’s reliance on the legitimate interests ground. The Investigator expressed the view, in this regard, that the Article 13(1)(d) requirement to identify the legitimate interests being pursued was: “a cumulative requirement, which results in Articles 13(1)(c) and 13(1)(d) operating together to place upon the data controller a requirement to set out the purposes of the processing in relation to the legitimate interests legal basis, along with the legitimate interests being pursued in carrying out the processing operations.” 273. The Investigator formed the view that the Legal Basis Notice “[conflated] the purposes of the processing of personal data with the legitimate interests relied upon to process personal data, without setting out any specific information in relation to the processing operation(s) or set of operations involved.” 274. Accordingly, the Investigator proposed a finding that WhatsApp failed to fully comply with its obligation to provide information in relation to the legitimate interests legal basis, pursuant to Articles 13(1)(c) and 13(1)(d) of the GDPR. 275. WhatsApp disagreed with the Investigator’s views. It submitted120 that: “In assessing the adequacy of the information provided, the Draft Report also fails to take into account that the description of the purpose of the processing will often, in and of itself, necessarily identify the nature of the legitimate interest in issue. The proposed finding is also based on a mischaracterisation of the obligation on a controller under Article 13(1)(c) – i.e. there is no need to specify “processing operations” ….” 276. The Investigator was unconvinced by WhatsApp’s submissions and confirmed her view, by way of Conclusion 9, that WhatsApp failed to fully comply with its obligation to provide information in relation to the legitimate interests legal basis, pursuant to Articles 13(1)(c) and 13(1)(d) of the GDPR.
Preliminary Issue: What information must be provided pursuant to Article 13(1)(c)? 277. As set out above, there was substantial disagreement, as between WhatsApp and the Investigator, in relation to what information is required to be provided by Article 13(1)(c). In the Investigator’s view, this provision requires a data controller to set out: a. “A description of the purposes of processing; b. A description of the operation, or set of operations, underlying that purpose, undertaken by the data controller; and c.
The legal basis relied upon by the data controller in order to carry out that processing operation, or set of operations.”
278. The Investigator was of the view that “this information must be provided in such a manner so that the link between the operation (or set of operations), its purpose and the legal basis is clear.” 120
The Inquiry Submissions, paragraph 11.1
82
