Article 83(5) and the applicable fining “cap”

proposed for the Article 14 infringement (in the range of between €30 and €50 million) was effective, proportionate and dissuasive in the circumstances of the inquiry, “taking into account all infringements.”

b. WhatsApp has further submitted that, rather than reassessing the fine originally proposed in respect of the Article 14 infringement, the Commission has simply reverted to the fine previously proposed without having any regard to WhatsApp’s previous submissions, made in response to the fine originally proposed.

857. In response to the above, WhatsApp appears to be suggesting that the fine proposed by the Composite Draft reflected all of the (then) three infringements that were found to have occurred. To be absolutely clear about the position, this is absolutely not the case and it is difficult to understand how WhatsApp could have formed this view, given the clear explanation, set out in the Composite Draft, as to the manner in which the Commission interpreted and applied Article 83(3).

858. As regards the Commission’s reinstatement of the fine originally proposed by the Supplemental Draft in respect of the Article 14 infringement, the manner in which the Commission has taken account of

WhatsApp’s various submissions is clearly set out in Part 5 of this Decision, including within the individual Article 83(2) assessments as well as my assessments of the Submissions on Recurring

Themes. It is therefore incorrect to suggest that the Commission failed to have regard to WhatsApp’s submissions. I further question why it might have been inappropriate for the Commission to have reinstated the fine that it originally proposed in circumstances where the impact, from the perspective of the Article 83(2) assessment, of the Board’s determination on the lossy hashing objections is materially identical to that originally outlined in the Preliminary Draft and Supplemental Draft decisions.

859. On the basis of the above, I am not inclined to make a downward adjustment to the fines proposed above to take account of WhatsApp’s Final Submissions.

Article 83(5) and the applicable fining “cap”

860. Turning, finally, to Article 83(5), I note that this provision operates to limit the maximum amount of any fine that may be imposed in respect of certain types of infringement, as follows:

“Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:

… (b) the data subjects’ rights pursuant to Articles 12 to 22; …”

861. In order to determine the applicable fining “cap”, it is firstly necessary to consider whether or not the fine is to be imposed on “an undertaking”. Recital 150 clarifies, in this regard, that:

“Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes.”

862. Accordingly, when considering a respondent’s status as an undertaking, the GDPR requires me to do so by reference to the concept of ‘undertaking’, as that term is understood in a competition law context. In this regard, that the Court of Justice of the EU (“the CJEU”) has established that:

“an undertaking encompasses every entity engaged in an economic activity regardless of the legal status of the entity and the way in which it is financed475”

863. The CJEU has held that a number of different enterprises could together comprise a single economic unit where one of those enterprises is able to exercise decisive influence over the behaviour of the others on the market. Such decisive influence may arise, for example, in the context of a parent company and its wholly owned subsidiary. Where an entity (such as a subsidiary) does not independently decide upon its own conduct on the market, but carries out, in all material respects, the instructions given to it by another entity (such as a parent), this means that both entities constitute a single economic unit and a single undertaking for the purpose of Articles 101 and 102 TFEU. The ability, on the part of the parent company, to exercise decisive influence over the subsidiary’s behaviour on the market, means that the conduct of the subsidiary may be imputed to the parent company, without having to establish the personal involvement of the parent company in the infringement476 .

864. In the context of Article 83, the concept of ‘undertaking’ means that, where there is another entity, such as a parent company, that is in a position to exercise decisive influence over the controller/processor’s behaviour on the market, then they will together constitute a single economic entity and a single undertaking. Accordingly, the relevant fining “cap” will be calculated by reference to the turnover of the undertaking as a whole, rather than the turnover of the controller or processor concerned.

865. In order to ascertain whether a subsidiary determines its conduct on the market independently, account must be taken of all the relevant factors relating to the economic, organisational and legal links which tie the subsidiary to the parent company, which may vary from case to case477 .

866. The CJEU has, however, established478 that, where a parent company has a 100% shareholding in a subsidiary, it follows that:

a. the parent company is able to exercise decisive influence over the conduct of the subsidiary; and

b. a rebuttable presumption arises that the parent company does in fact exercise a decisive influence over the conduct of its subsidiary.

867. The CJEU has also established that, in a case where a company holds all or almost all of the capital of an intermediate company which, in turn, holds all or almost all of the capital of a subsidiary of its group, there is also a rebuttable presumption that that company exercises a decisive influence

475 Höfner and Elser v Macrotron GmbH (Case C-41/90, judgment delivered 23 April 1991), EU:C:1991:161 §21 476 Akzo Nobel and Others v Commission, (Case C-97/08 P, judgment delivered 10 September 2009) EU:C:2009:536, § 58 61 477 Ori Martin and SLM v Commission (C-490/15 P, judgment delivered 14 September 2016) ECLI:EU:C:2016:678 § 60 478 Akzo Nobel and Others v Commission, (C-97/08 P, judgment delivered 10 September 2009)

over the conduct of the intermediate company and indirectly, via that company, also over the conduct of that subsidiary479 .

868. The General Court has further held that, in effect, the presumption may be applied in any case where the parent company is in a similar situation to that of a sole owner as regards its power to exercise a decisive influence over the conduct of its subsidiary480. This reflects the position that:

“… the presumption of actual exercise of decisive influence is based, in essence, on the premiss that the fact that a parent company holds all or virtually all the share capital of its subsidiary enables the Commission to conclude, without supporting evidence, that that parent company has the power to exercise a decisive influence over the subsidiary without there being any need to take into account the interests of other shareholders when adopting strategic decisions or in the day-to-day business of that subsidiary, which does not determine its own market conduct independently, but in accordance with the wishes of that parent company … 481”

869. Where the presumption of decisive influence has been raised, it may be rebutted by the production of sufficient evidence that shows, by reference to the economic, organisational and legal links between the two entities, that the subsidiary acts independently on the market.

Application of the above to the within inquiry

870. Having reviewed the Directors’ Report and Financial Statements filed, on behalf of WhatsApp, with the Irish Companies Registration Office (in respect of the financial period from 6 July 2017 to 31 December 2018)482, I note that this document confirms, on page 3, that:

“Principal activity and review of the business

WhatsApp Ireland Limited (“the company”) is owned by WhatsApp Inc., a company incorporated in the United States of America, which is its immediate parent undertaking and controlling party. The ultimate holding company and controlling party is Facebook, Inc., a company incorporated in the United States of America.

WhatsApp is a simple, reliable and secure messaging application that is used by people and businesses around the world to communicate in a private way. The principal activity of the company is acting as the data controller for European users of the WhatsApp service and the provision of support services to WhatsApp Inc.

479 Judgment of 8 May 2013, Eni v Commission, Case C-508/11 P, EU:C:2013:289, paragraph 48 480 Judgments of 7 June 2011, Total and Elf Aquitaine v Commission, T-206/06, not published, EU:T:2011:250, paragraph 56; of 12 December 2014, Repsol Lubricantes y Especialidades and Others v Commission, T-562/08, not published, EU:T:2014:1078, paragraph 42; and of 15 July 2015, Socitrel and Companhia Previdente v Commission, T-413/10 and T-414/10, EU:T:2015:500, paragraph 204 481 Opinion of Advocate General Kokott in Akzo Nobel and Others v Commission, C-97/08 P, EU:C:2009:262, point 73 (as cited in judgment of 12 July 2018, The Goldman Sachs Group, Inc. v European Commission, Case T-419/14, ECLI:EU:T:2018:445, paragraph 51) 482 While I note that WhatsApp has since filed its Directors Report and Financial Statements for the financial year ending 31 December 2019, I note that the relevant information set out therein is materially identical to that recorded in this Decision.

Going concern

The company’s ultimate parent undertaking, Facebook, Inc., has given written assurances that adequate funds will be made available to the company to ensure that liabilities will be discharged at the amount at which they are stated in the financial statements and to continue to fund the operations of the company for a period of at least twelve months from the date of approval of these financial statements. The company therefore continues to adopt the going concern basis in preparing its financial statements.”

871. Page 18 further confirms that:

“Controlling parties

At 31 December 2018, the company was a wholly-owned subsidiary of WhatsApp Inc., a company incorporated in Wilmington, Delaware, United States of America.

The ultimate holding company and ultimate controlling party is Facebook Inc., a company incorporated in Wilmington, Delaware, United States of America. The ultimate holding company and controlling party of the smallest and largest group of which the company is a member, and for which consolidated financial statements are drawn up, is Facebook, Inc.”

872. On the basis of the above, it appears that:

a. WhatsApp is the wholly owned subsidiary of WhatsApp Inc.;

b. WhatsApp Inc. is ultimately owned and controlled by Facebook, Inc.; and

c. As regards any intermediary companies in the corporate chain, between WhatsApp and

Facebook, Inc., it is assumed by reference to the statement recorded above, that the “ultimate holding company and controlling party of the smallest and largest group of which [WhatsApp] is a member … is Facebook, Inc.”

873. It follows, therefore, that:

a. The corporate structure of the entities concerned and, in particular, the fact that Facebook,

Inc. owns and controls WhatsApp Inc. means that Facebook, Inc. is able to exercise decisive influence over WhatsApp’s behaviour on the market; and

b. A rebuttable presumption arises that Facebook, Inc. does in fact exercise a decisive influence over the conduct of WhatsApp on the market.

874. If this presumption is not rebutted, it means that Facebook, Inc. and WhatsApp constitute a single economic unit and therefore form a single undertaking within the meaning of Article 101 TFEU.

875. Having put483 the above to WhatsApp, WhatsApp confirmed484 that:

483 By way of letter dated 24 April 2020 from the Commission to WhatsApp 484 By way of letter dated 1 May 2020 from WhatsApp to the Commission

a. “[It] is a wholly-owned subsidiary of WhatsApp Inc.; and

b. WhatsApp Inc. is ultimately a wholly-owned subsidiary of Facebook, Inc.”

876. WhatsApp, however, did not furnish any evidence directed to the rebuttal of the presumption. Instead, it advised that:

“To the extent relevant (if at all) to the imposition or amount of any administrative fine under the GDPR (please see the questions we have in this respect below), we do not believe that, as a result of the corporate structure of the entities concerned, either WhatsApp Inc. or Facebook, Inc. exercises “decisive influence” over [WhatsApp’s] “behaviour on the market” in the way that such phrases would need to be interpreted in order to make sense in the context of the GDPR.”

877. In response to my request485 that WhatsApp bring the matter to the attention of “any parent or controlling company as might be required to fully address the matters raised” WhatsApp advised486 that:

“While neither WhatsApp Inc. nor Facebook, Inc. are parties to the Inquiry, we confirm that we have brought your letter and this response to the attention of personnel at WhatsApp Inc. and Facebook, Inc. on a voluntary basis. However, it is not clear at present how input from those entities might be required to address the matters raised in your letter, or why they might have matters to raise which could be relevant in the circumstances. We would be grateful for any clarification you are able to provide in this respect, and we can then consider the matter further.”

878. I wrote further to WhatsApp487, answering each of the questions raised and providing the clarification sought. I repeated the presumption arising and repeated my request that WhatsApp confirm whether or not it agreed with my assessment. As before, I requested that, in the event that WhatsApp did not agree with my assessment, it should detail “by reference to the economic, organisational and legal links between the [entities concerned], why [it so disagreed]”. I also repeated my request that WhatsApp bring my letter to the attention of “any parent or controlling company, as might be required to fully address the matters raised”.

879. In response488, WhatsApp (via its legal advisors) advised that it did not agree with the position that had been outlined in relation to how “competition law concepts” should be transposed to the “very different statutory context of the GDPR”. WhatsApp advised that it had not set out “the detailed reasons why it disagrees” with the position that had been outlined to it and that:

“Instead, [WhatsApp] reserves its right to raise these reasons at the appropriate stage in the Inquiry, namely in response to any draft corrective measures decision, if necessary.”

880. Notwithstanding the reasons subsequently raised by WhatsApp in its response to the Supplemental Draft (which I have dealt with below), by reference to the information set out above and in the absence of any evidence to the contrary, I find that:

485 Included in the letter dated 24 April 2020 from the Commission to WhatsApp 486 Included in the letter dated 1 May 2020 from WhatsApp to the Commission 487 By way of letter dated 18 May 2020, from the Commission to WhatsApp 488 Communicated by way of letter dated 25 May 2018 from Mason Hayes & Curran, solicitors to the Commission

a. The corporate structure of the entities concerned and, in particular, the facts that:

i. WhatsApp is a wholly-owned subsidiary of WhatsApp Inc.; and

ii. WhatsApp Inc. is a wholly-owned subsidiary of Facebook, Inc.

means that Facebook, Inc. is able to exercise decisive influence over WhatsApp’s behaviour on the market;

b. On this basis, a rebuttable presumption arises that Facebook, Inc. does in fact exercise a decisive influence over the conduct of WhatsApp on the market;

c. This presumption has not been rebutted; and

d. Consequently, WhatsApp and Facebook, Inc. constitute a single economic unit and, thereby, a single undertaking for the purpose of Articles 101 and 102 TFEU.

881. Applying the above to Article 83(5), I firstly noted that, in circumstances where the fine is being imposed on an ‘undertaking’, a fine of up to 4% of the total worldwide annual turnover of the preceding financial year may be imposed. WhatsApp confirmed489 that the combined turnover for Facebook, Inc. and WhatsApp Ireland for the year ending 31 December 2019 was approximately . That being the case, the fine proposed to be imposed (in respect of the Article 14 Infringement), did not exceed the applicable fining “cap” prescribed by Article 83(5).

WhatsApp’s Submissions and Assessment of Decision-Maker

882. As noted above, WhatsApp raised objections on the rationale set out above, which had been set out in the Supplemental Draft. In doing so, WhatsApp submitted490 that the views set out above, as to the manner of identification of the relevant undertaking are “wrong as a matter of fact and law”.

While reserving its right to make submissions “in relation to such matters in due course as necessary or appropriate”, WhatsApp summarized the reasons why it disagrees with the Commission’s assessment, as follows:

a. The competition law concept of decisive influence does not directly translate in the context of the GDPR, which pursues different objectives to Articles 101 and 102 TFEU.

b. The Commission has not engaged with the question as to what “behavior on the market” means in a GDPR context.

c. “For the competition law concept of decisive influence to have any real meaning in the context of the GDPR, it must be adapted accordingly, in a similar way to how the concept of “dominant influence” in Recital 37 GDPR has been adapted … by encompassing, for example, the ability to control the processing activities of subsidiaries”.

489 By way of its letter to the Commission dated 1 October 2020 490 The Supplemental Draft Submissions, paragraphs 18.5 to 18.9 (inclusive)