Identified Legal Basis 2: Consent

341. WhatsApp also submitted that the proposed finding “conflicts with suggestions given by the

Commission as part of its pre-GDPR engagement with WhatsApp, as evidenced in an email dated 11

April 2018, in which the Commission confirmed that the use of “technological design” and “hyperlinks to specific portions of the Terms/Privacy Policy” in the Legal Basis Notice was recommended139.”

342. It is clear that WhatsApp and I fundamentally disagree as to my assessment of the information provided by WhatsApp to users under this heading. I have already set out above the reasons why I consider the information provided to be insufficient, in terms of quality and the manner of delivery. My assessment, in this regard, already takes account of the matters raised by WhatsApp in the Preliminary Draft Submissions and my concerns remain, notwithstanding WhatsApp’s perspective on matters. Further, I do not agree with WhatsApp’s submission concerning “the benefit to users of more generally providing a range of easily accessible tools, settings and measures” or “the ease with which the user can navigate from the Privacy Policy to the linked Legal Basis Notice and to the Terms of

Service (and back) …”. Such matters are only beneficial to the user if the user has been provided with the information that he/she is entitled to receive (which I do not consider to be the case here). Finally, my assessment of WhatsApp’s submissions concerning its pre-GDPR engagement with the

Commission’s Consultation Unit has already been considered as part of my assessment of WhatsApp’s Submissions of General Application, above.

Identified Legal Basis 2: Consent

What information has been provided?

343. In this section, I examine whether there has been compliance with Article 13(1)(c), insofar as WhatsApp refers to reliance on the legal basis set out in Article 6(1)(a) (consent). With regard to

WhatsApp’s reliance on consent, the Legal Basis Notice provides that:

“The other legal bases we rely on in certain instances when processing your data are: … Your Consent For collecting and using information you allow us to receive through the device-based settings when you enable them (such as access to your GPS location, camera, or photos), so we can provide the features and services described when you enable the settings.”

How has the information been provided?

344. The information set out above has been provided in a clear and concise manner.

Assessment of Decision-Maker

345. While the manner in which the information has been made available to the user is clear and concise, the quality of the information provided is insufficient in that it fails to identify the processing operations that will be grounded upon the user’s consent. It further fails to identify the categories of data that will be processed for the processing operations that will be grounded upon the user’s consent. I note, in this regard, that the information provided specifically references the “collection” and “use” of information that the user “allows” WhatsApp to receive through the device-based settings, such as access to the user’s GPS location, camera or photos.

139 The Preliminary Draft Submissions, paragraph 7.4

346. In the “Information We Collect” section of the Privacy Policy (a link to which is embedded on the “Our

Legal Bases For Processing Information” sub-section of the Privacy Policy), however, the user is informed as follows:

 “Location Information. We collect device location information if you use our location features, like when you choose to share your location with your contacts, view locations nearby or those others have shared with you, and the like, and for diagnostics and troubleshooting purposes such as if you are having trouble with our app's location features.

We use various technologies to determine location, including IP, GPS, Bluetooth signals, and information about nearby Wi-Fi access points, beacons, and cell towers.” [emphasis added]

347. While it is perfectly obvious that WhatsApp will use device location information if the user decides to enable his/her device-based settings so as to avail of WhatsApp’s location features, it is not clear, from the above, whether WhatsApp will carry out any further processing operations and, if so, what particular processing operations, on the user’s location data (as suggested by the use of the word

“collect” in the text quoted above).

WhatsApp’s Response to Assessment of Decision-Maker

348. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above assessment, submitting that: “(t)he exact processing depends on the feature that is used by the user and WhatsApp provides further information in this regard, including at the time the user makes the choice. … Additionally, the categories of location data that are collected are identified in the Location

Information section of the … Privacy Policy140.” WhatsApp further provided the consent user flows for location data, by way of an appendix to the Preliminary Draft Submissions. WhatsApp submitted, in this regard, that the user flows inform the user as to the purpose of the processing. The user flows submitted contain the following text:

User Flow 1:

“To send a nearby place or your location, allow WhatsApp access to your location.

[Options provided:] NOT NOW [or] CONTINUE”

User Flow 2:

“Allow WhatsApp to access this device’s location?

[Options provided:] Deny [or] Allow

349. As before, it is clear that WhatsApp and I fundamentally disagree as to my assessment of the information provided by WhatsApp to users under this heading. I have already set out above the reasons why I consider the information provided to be insufficient, in terms of the quality of information provided. My concerns remain, in this regard, notwithstanding WhatsApp’s perspective on matters. I acknowledge, for example, WhatsApp’s submission that the exact processing, in any case, will depend on the feature that is selected by the user. However, neither the submissions nor the sample user flows provided demonstrate that the required further information, in relation to the processing that will take place, is actually provided to the user, either at the time the user makes the choice to activate a particular feature or otherwise.

140 The Preliminary Draft Submissions, paragraph 7.10