the Draft Decision and an additional infringement of Article 14 GDPR). Finally, the EDPB finds that the objection of the IT SA clearly demonstrates the significance of the risks posed to the fundamental rights and freedoms of the data subjects by the Draft Decision, as it explains that this decision would lead to a “serious impairment of non-users’ fundamental right to be informed, as well as the inadequate and disproportionate corrective measures and fining that are envisioned vis-a-vis the controller’’ 105. 140. On this basis, the EDPB considers that the objection raised by the IT SA is a relevant and reasoned objection pursuant to Article 4(24) GDPR.
6.4.2 Assessment on the merits 141. The EDPB considers that the objections found to be relevant and reasoned in this subsection 106 require an assessment of whether, in the case at hand, the Lossy Hashing procedure indicated by WhatsApp IE achieves the anonymisation of personal data so as to render the GDPR no longer applicable. In this context, the EDPB already notes that a lossy hashed non-user phone number is stored by WhatsApp IE in a table (hereinafter called “Non-User list”), linking a lossy hash to mobile phone numbers of those users who uploaded numbers via the Contact Features that fall into the group of different phone numbers that would have generated that same lossy hash 107. 142. The procedure of lossy hashing is detailed by WhatsApp IE as consisting of the following steps:
143. WhatsApp IE explains that this table is used to select the existing users to which a so-called ‘notification hash’ is sent when a new user joins the service. This selection is done by performing the Lossy Hashing procedure with the phone number of the new user and then sending the ‘notification hash’ to all those users who have uploaded any one of the pool of numbers which are represented by the lossy hash, that are linked to it in the above-mentioned table. Once WhatsApp IE’s application on a user’s device receives a notification hash, it will create an equivalent notification hash of the users in its address
IT SA Objection, p. 2-3. These objections are those of the DE SA, FR SA, HU SA, IT SA and PT SA. 107 WhatsApp Article 65 Submissions, paragraph 3.3, step 3. 108 WhatsApp Submissions in response to the Lossy Hashing objections (hereinafter, “WhatsApp LH Submissions”), paragraph 9. 105 106
Adopted
29
