Facebook and, therefore, “it would be necessary to examine in detail what data processing takes place” 138. The DE SA considers that, without a thorough investigation of these issues, “it makes no sense to check transparency issues and the right to be informed” 139 and, therefore, they should have been investigated. *** 161. The HU SA raised an objection arguing that since consent needs to be informed, and the LSA found that WhatsApp IE had failed to properly inform data subjects, the Draft Decision should include that in case of consent-based processing, consent was invalid and WhatsApp IE had been processing personal data without a legal basis for years.
7.1.3 Position of the LSA on the objections 162. The LSA considered that the objections raised by the DE SA regarding the scope of the investigation were not relevant and reasoned, since they fall outside the scope of the Inquiry 140. The IE SA emphasises that the Inquiry underpinning the Draft Decision was purposefully focused on WhatsApp IE’s transparency obligations 141. 163. The IE SA further states that, as expressed in the Draft Decision, “the findings and outcome of the inquiry are without prejudice to any assessment of the legal bases being relied upon to support the processing of personal data” 142, and that a separate inquiry regarding that matter is underway 143. Thus, the IE SA highlights that the Draft Decision does not prevent further inquiries on the legitimacy of the processing 144. Likewise, the IE SA underlines that the Inquiry did not assess WhatsApp IE’s obligations regarding international data transfers and that the IE SA has commenced an inquiry examining the legality of Facebook’s data transfers to the United States of America 145. 164. Concerning the involvement of the CSA(s) in the determination of the own-volition inquiry, the IE SA notes that, while the DE SA relies on the RRO Guidelines to make that claim, the Inquiry commenced well before the preparation and adoption of the RRO Guidelines 146. In addition, the IE SA considers that “the entitlement of the LSA to determine the scope of its own inquiries reflects the entitlement of each supervisory authority to manage its own resources and to regulate its own procedures” and “the fact that the LSA is primarily responsible for defending the adopted decision [...] in the event of an appeal” 147. The IE SA further notes that the approach adopted regarding the scope of the Inquiry does not entail any risk of non-uniform application of EU law, since the GDPR does not establish any particular requirement as to the scope of the investigations carried out by the SAs 148. 165. As to the lack of investigation of the factual level, the IE SA argues that, given the findings on the deficiency of the information provided, the outcome of the transparency assessment would not
DE SA Objection, p. 7. DE SA Objection, p. 8. 140 IE SA Composite Response, paragraph 12. 141 IE SA Composite Response, paragraph 14. 142 IE SA Composite Response, paragraph 16.a. 143 IE SA Composite Response, paragraph 16.a. 144 IE SA Composite Response, paragraph 16.e. 145 IE SA Composite Response, paragraph 16.d. 146 IE SA Composite Response, paragraph 16.b. 147 IE SA Composite Response, paragraph 16.b. 148 IE SA Composite Response, paragraph 16.c. 138 139
Adopted
34
