Assessment of Decision-Maker: What information has been provided?

420. WhatsApp rejected this proposed finding. It submitted173 that:

“Under the “Information You and We Share” section of the Privacy Policy, WhatsApp separately identifies “third party service providers” as a category of recipients. WhatsApp details, in clear and plain language and in a concise manner, the types of processing activities that these service providers undertake for WhatsApp as well as giving assurances as to the contractual obligations on those providers. Examples ensure that users can understand how these companies provide services to and on behalf of WhatsApp, whilst avoiding technical or complex terms like data processor or data processing agreement.

421. The Investigator was unconvinced by WhatsApp’s submissions, in this regard, and confirmed her view, by way of Conclusion 10, that the information provided by WhatsApp failed to satisfy the requirements of Articles 13(1)(e) and 12(1) of the GDPR.

Assessment of Decision-Maker: What information has been provided?

422. The sections of the Privacy Policy identified by WhatsApp contain the following relevant information:

“Information You And We Share … we share your information to help us operate, provide, improve, understand, customize, support, and market our Services.  …  Businesses On WhatsApp. We help businesses who use WhatsApp measure the effectiveness and distribution of their services and messages, and understand how people interact with them on our Services.  Third-Party Service Providers. We work with third-party service providers and the Facebook Companies to help us operate, provide, improve, understand, customize, support, and market our Services. ….  … . “

423. Also:

“How We Work With Other Facebook Companies We are part of the Facebook Companies. As part of the Facebook Companies, WhatsApp receives information from, and shares information with, the Facebook Companies. …. Learn More about how WhatsApp works with the Facebook Companies.”

424. And, finally:

“Assignment, Change of Control, And Transfer All of our rights and obligations under our Privacy Policy are freely assignable by us to any of our affiliates, in connection with a merger, acquisition, restructuring, or sale of assets, or by operation of law or otherwise, and we may transfer your information to any of our affiliates, successor entities, or new owner.”

173 The Inquiry Submissions, paragraph 12.2