Article 83(2)(k): any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement

other words, this is neither an aggravating factor nor a mitigating one for the purpose of the within assessment.

Article 83(2)(k): any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement

785. The relevant considerations arising under this heading are as follows:

a. WhatsApp does not charge users in the context of the Service.

b. The Article 14 infringement relates to the processing of non-user data pursuant to the activation, by users, of the Contact Feature. According to WhatsApp393, the Contact Feature is a “popular” voluntary feature of the Service. Non-user data is processed by way of the

Contact Feature so as to be able to “quickly and conveniently update [a user’s] contacts list on the Service as and when any of those non-users join the Service394.” In this way, the Contact

Feature envisages, and is directed to facilitating, the continued growth of WhatsApp’s userbase.

c. While the continued growth of WhatsApp’s user-base will not necessarily result in a direct financial benefit in the form of new subscription fees, it will increase WhatsApp’s presence on the market and thereby potentially increase its value. I note, in this regard, the information provided in the Facebook FAQ395, that:

“We can also count how many unique users WhatsApp has … . This will help WhatsApp more completely report the activity on our service, including to investors and regulators.” [emphasis added] d. The question that arises, therefore, is whether or not a more transparent approach to the data protection issues arising in the context of the Contact Feature would have a positive, negative or neutral effect on the continued growth of WhatsApp’s user base. I expressed the view, in the Supplemental Draft, that a more transparent approach to the Contact Feature would represent a risk factor for the continued growth of WhatsApp’s user base in circumstances where existing and prospective users might be encouraged, by concerned non-users, to opt for an alternative service that does not process the personal data of non-users.

WhatsApp’s Response and Assessment of Decision-Maker

786. In response, WhatsApp submits396 that the “reasoning that a more transparent approach would represent a risk factor to the continued growth of WhatsApp’s user base is not supported by any evidence, and appears to be based on a number of incorrect assumptions.”. It submits, in this regard, that:

a. No account appears to have been taken of the fact that users themselves are free to choose whether or not to use the Contact Feature as part of the Service.

393 Response to Investigator’s Questions, WhatsApp’s answer to question 3 394 Response to Investigator’s Questions, WhatsApp’s answer to question 3a. 395 Available at https://faq.whatsapp.com/general/26000112/?eea=1 (the “Facebook FAQ”) 396 The Supplemental Draft Submissions, paragraphs 15.2 to 15.6 (inclusive)

b. “Moreover, in order to conclude that a significant proportion of non-users have decided not to use the Service on the basis of privacy concerns, and so would be unhappy that WhatsApp processes their data, the Commission has sought to rely on assertions made in a 2014 article on the website techcrunch.com, which itself was re-reporting a single article, focusing on

Germany, on the website of Suddeutsche Zeitung. This article asserted that some people may have been looking for alternative messaging services in the days following the announcement on 19 February 2014 that Facebook was acquiring WhatsApp Inc. Contrary to the unsupported assertions contained in these 2014 articles, according to the data retained from this period,

WhatsApp has found no statistically significant variation in account registrations in Germany in the days following 19 February 2014. Indeed, when numbers across the EEA and UK are considered it would seem that the announcement of this acquisition coincided with an overall increase in new account registrations397.”

c. A footnote to the above paragraph clarifies, in this regard, that “(w)hile the data retained by

WhatsApp does not include data regarding account deletions, WhatsApp’s review of registrations from this period show that new use registrations increased immediately following the announcement, to significantly above the average daily registrations for 2014, on 20

February 2014.”

d. WhatsApp further submits that, in any event, such allegations should not have been raised for the first time at the corrective measures decision-making stage.

e. WhatsApp has further made it clear that it intends to improve the “educational information” that it provides to users in relation to the Contact Feature. WhatsApp does not expect this to result in a decline in the number of users, to slow the growth of users or to impact on the value of the business in any way. WhatsApp’s position is that, if, in fact, it were to have further explained the manner in which it processes non-users phone numbers via the Contact Feature publicly “(i.e. in addition to what is already said in this respect in its Privacy Policy)”, given the highly privacy protective manner of the relevant processing, it is likely that non-users would have been reassured by the way in which their information is processed by WhatsApp. This,

WhatsApp submits, “if anything, would have supported the Service’s further growth.”

787. For the reasons outlined above, WhatsApp’s view is that the conclusion originally outlined should be removed.

788. I note that the “conclusion” under challenge was the conclusion that I reached, on a preliminary basis, as regards whether or not a more transparent approach to the data protection issues arising in the context of the Contact Feature would have a positive, negative or neutral effect on the continued growth of WhatsApp’s user base. I provisionally concluded that a more transparent approach would represent a risk factor on the basis that existing and prospective users “might be encouraged” by concerned non-users to seek out an alternative service that does not process the personal data of non-users.

397 The Supplemental Draft Submissions, paragraph 15.3

789. WhatsApp appears to have correlated the above (proposed) conclusion with the article referenced within the Article 83(2)(a) assessment (in the part dedicated to consideration of the “level of damage suffered” by data subjects). The article was referenced, within that aspect of the assessment, to illustrate one way in which a data subject may exercise control over his/her personal data. In the example presented, the data subjects exercised control by choosing an alternative service. The article itself was not taken into account within the Article 83(2)(a) assessment; indeed, it could not possibly have been since it did not concern the within inquiry nor the (then proposed) Infringements.

790. Returning to the matter under assessment, I made no reference whatsoever to the article in my preliminary assessment of Article 83(2)(k). I formed my view on the basis that it is not clear, from the Privacy Policy or related material, that the activation of the Contact Feature will result in WhatsApp processing the mobile phone numbers of non-users. Neither is it clear how, or for how long, WhatsApp will process that data. Most significantly, the consequences, for the non-user, crystallising at the point in time at which he/she has joined the Service are not clearly set out. As WhatsApp has acknowledged, non-users contact it to exercise their data subject rights, from time to time. Some of those individuals, despite having been provided with further information about the processing that takes place on non-user data, have gone on to lodge complaints with supervisory authorities. It is therefore clear that, certainly for a cohort of non-users, the provision of further information, does not satisfy their concerns.

791. WhatsApp has submitted that the provisional conclusion referred to above (which was originally set out in the Supplemental Draft) does not take account of the fact that users themselves are free to choose whether or not to use the Contact Feature as part of the Service. I take it that, by this submission, WhatsApp is suggesting that a user could avail of the Service without activating the

Contact Feature. While this is, of course, a possibility, I note that this would limit the user’s ability to communicate by way of the Service. In any event, I do not consider this argument to be persuasive in circumstances where there is insufficient information for users concerning the impact of the Contact Feature so as to enable them to make an informed choice as to whether to activate it.

792. Given that I did not reach my conclusion by reference to the article discussed by WhatsApp in its submissions, I do not need to consider those submissions, in this context.

793. As regards the submission that it was the role of the Commission’s inquiry team to raise any such

“factual allegations”, I note that no such allegations were raised as part of my assessment under this heading. Even if this were not the case, however, I have already explained that consideration of the Article 83(2) factors is the sole preserve of the Decision-Maker; it is outside of the scope of the investigator to consider matters beyond the question of whether or not an infringement has occurred/is occurring.

794. I finally note WhatsApp’s submission that it intends to improve the “educational information” that it provides to users in relation to the Contact Feature and that, in WhatsApp’s view, “it is likely” that non-users would be reassured by the way in which their data is processed by WhatsApp. As already observed, above, and as referred to by WhatsApp in its Supplemental Draft Submissions, there have been cases whereby non-users, having received an explanation from WhatsApp as to the privacy protective manner in which their personal data has been processed, have nonetheless lodged complaints with a supervisory authority. It is therefore clear that, for this cohort of non-users, the provision of additional information has not had the desired reassuring effect. I further question why,

if WhatsApp believes that the provision of this information would not only reassure non-users but also support the Service’s further growth, it has not made publicly available the information that it provides to individual non-users upon request.

795. In terms of how I might take account of WhatsApp’s submissions, above, I note that our respective positions effectively cancel each other out. Neither I nor WhatsApp can know, until the contingent event has happened, which one of us is correct in our belief as to the likely impact, on the continued growth of the user base, of a more transparent approach to the data protection issues arising in the context of the Contact Feature. For this reason, I will amend my previously proposed conclusion to reflect that I am unable to predict the likely outcome of a more transparent approach on the continued growth of WhatsApp’s user base.

796. WhatsApp has further submitted398 that:

“it is incorrect to claim that it was designed for the purpose of growing WhatsApp’s user base. For example, the Contact Feature is not used as a way to somehow identify non-users in order to promote WhatsApp’s services to them. Instead, it was designed to ensure the best possible experience for existing users.”

797. The relevant assessment did not contain any such claim. The assessment clearly records my view that the Contact Feature “envisages” – which it does – and “is directed to facilitating” – which it also does – the continued growth of WhatsApp’s user-base. I further note that the assessment did not contain any suggestion that the Contact Feature might be used to “somehow identify non-users in order to promote WhatsApp’s service to them”. In the circumstances, it is not necessary for me to take account of these particular submissions within my assessment.

798. WhatsApp also considers that I must take account of “the fact that [WhatsApp] already publicly explains that it accesses non-user data in its Privacy Policy … which in itself undermines the

Commission’s conclusion in this regard.” I have already set out my view that the information provided by WhatsApp, in this regard, is wholly insufficient. Accordingly, and for the reasons that are explained further in my assessment of the Submissions on Recurring Themes, I am unable to take account of this submission, as a mitigating factor for the purpose of this aspect of my assessment.

799. Finally, WhatsApp submits that I should take account, as a mitigating factor, of the fact that “no material financial gains were made in relation to the alleged infringements at issue399”. As previously explained, it is not necessarily the case that each individual assessment carried out for the purpose of Article 83(2) must result in a conclusion that the matter arising is either an aggravating factor or a mitigating one. In having departed from my previous assessment and having now reached a conclusion where I am unable to determine the impact that a more transparent approach would have on the continued growth of WhatsApp’s user base, my view is that this is neither an aggravating factor nor a mitigating one for the purpose of the within assessment.

398 The Supplemental Draft Submissions, paragraph 15.7 399 The Supplemental Draft Submissions, paragraph 15.7