The European Data Protection Board ('EDPB') announced, on 24 January 2023, the publication of its binding decision, which it had issued, on 5 December 2022, on the basis of Article 65(1)(a) of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), on the dispute submitted by the Data Protection Commission ('DPC') on WhatsApp Ireland Limited. In particular, the EDPB noted that it had instructed the DPC to amend its draft decision with respect to the findings concerning the lawfulness of the processing and the principle of fairness, and to the corrective measures envisaged. Specifically, the EDPB decided that WhatsApp had inappropriately relied on contract as a legal basis to process personal data. Therefore, the EDPB instructed the DPC to add an infringement of Article 6(1) of the GDPR, as well as an infringement of the principle of fairness under Article 5(1)(a) of the GDPR.

Moreover, the EDPB decided that the DPC must carry out an investigation into WhatsApp's processing operations in order to determine whether it processes:

• special categories of personal data in compliance with Article 9 of the GDPR; and
• personal data for the purposes of behavioural advertising, for marketing purposes, as well as for the provision of metrics to third parties and the exchange of data with affiliated companies for the purposes of service improvements.

Moreover, the EDPB outlined that it had requested the DPC, among other things, to include in its final decision an order for WhatsApp to bring its processing operations into compliance with Article 6(1) of the GDPR within a certain timeframe, and to issue a monetary penalty. Accordingly, the EDPB reminded that, in light of the binding decision, the DPC imposed a fine of €5.5 million against WhatsApp.

You can read the press release here and the binding decision here.