Assessment: Article 13(2)(b) – the existence of the data subject rights

Inquiry Submissions192; had it not been drawn to my attention, I would not have known of its existence.

474. Accordingly, I proposed a finding, in the Preliminary Draft, that WhatsApp has failed to comply with its obligations pursuant to Article 13(2)(a) in circumstances where:

a. No meaningful information has been provided in relation to the criteria that will be used to determine if, and for how long, a user’s personal data will be retained following the deletion of his/her account;

b. Key information concerning the fact that certain information (“materials such as log records”) will be retained, even after deletion, has not been incorporated into the Privacy Policy; and

c. Key information to explain how such retained records (i.e. those “materials such as log records”) are “disassociated from personal identifiers” has not been incorporated into the Privacy Policy.

WhatsApp’s Response to Proposed Finding and Assessment of Decision-Maker

475. WhatsApp, by way of the Preliminary Draft Submissions, maintained its position that, as far as it is concerned, it provides the information required by Article 13(2)(a). However, it further confirmed that, having reflected carefully on the Commission’s views, it intends to make changes to the information that it provides to users under this heading193 .

476. In the absence of any substantive submissions from WhatsApp under this heading, my views remain as set out above. Accordingly, I find that WhatsApp has failed to comply with its obligations under

Article 13(2)(a).

Assessment: Article 13(2)(b) – the existence of the data subject rights

Required Information and WhatsApp’s Response to Investigator’s Questions

477. Article 13(2)(b) requires the data controller to inform the data subject as to “the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability”.

478. In its Response to Investigator’s Questions, WhatsApp confirmed, by reference to question 6, that:

“[WhatsApp] explains the rights specified in Article 13(2)(b) in the Privacy Policy, under the section entitled ‘How You Exercise Your Rights’.”

The Investigator’s Proposed Finding, WhatsApp’s Inquiry Submissions and the Investigator’s Conclusion

479. While the Investigator did not propose or confirm any particular finding or conclusion under this heading, she confirmed, in the Draft Report and Final Report, that she was satisfied that WhatsApp

192 The Inquiry Submissions, paragraph 17.2 (and footnote number 77) 193 The Preliminary Draft Submissions, paragraph 10.2