Assessment: Article 13(1)(f) – Transfers of personal data to a third country

433. WhatsApp, by way of the Preliminary Draft Submissions, confirmed its disagreement with the above assessment, submitting that:

“for the same reasons as set out above in relation to Article 13(1)(c) GDPR, WhatsApp disagrees with the Commission’s analysis that granular information should be provided to users identifying the categories of personal data which will be received by the identified categories of recipients. This requirement departs from the clear language of the GDPR and is supplemental to the information points outlined by the Transparency Guidelines on Article 13(1)(e)177.”

434. It is clear that WhatsApp and I fundamentally disagree as to my assessment of the information provided by WhatsApp to users under this heading. I have already set above the reasons why I consider the information provided to be insufficient, in terms of quality and the manner of delivery. My concerns remain, in this regard, notwithstanding WhatsApp’s perspective on matters. I acknowledge, however, that WhatsApp has decided178 to relocate the “Assignment,

Change of Control and Transfer” section to the Terms of Service, in light of the views I expressed in the Preliminary Draft. Accordingly, for the reasons already set out above, I find that

WhatsApp has failed to comply with its obligations pursuant to Article 13(1)(e) and Article 12(1).

Assessment: Article 13(1)(f) – Transfers of personal data to a third country

Required Information and WhatsApp’s Response to Investigator’s Questions

435. Article 13(1)(f) requires the data controller, “where applicable”, to inform the data subject “that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the [European] Commission, or in the case of transfers referred to in Article 46 or 47, or the second paragraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.”

436. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 4, that:

“[WhatsApp] identifies the fact that it intends to transfer personal data to a third country or international organisation in the ‘Our Global Operations’ section of the Privacy Policy.”

The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s Conclusion

437. The Investigator considered the extent to which WhatsApp complied with its obligations under this heading by reference to Proposed Finding 11. She expressed the view that the information provided was not sufficiently clear to satisfy the requirements of Article 12(1) of the GDPR. Further, the use of conditional language (“may”), in the context of possible reliance on adequacy decisions, was, in the

Investigator’s view, contrary to the requirement for a data controller to provide clear and transparent information to data subjects.

177 The Preliminary Draft Submissions, paragraph 8.3 178 The Preliminary Draft Submissions, paragraph 8.5