The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI') announced, on 13 April 2021, that it had brought urgent proceedings against Facebook Ireland Ltd., on the basis of Article 66 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following the recent updates to WhatsApp's privacy policy and terms of use. In particular, the HmbBfDI highlighted that the revised privacy policy and terms of use contain extensive passages in which the company grants itself the right to share user's data with other Facebook companies. Furthermore, the HmbBfDI outlined that Facebook's privacy policy also provides for general cross-company use and evaluation of data from affiliated companies. As such, the HmbBfDI expressed concerns that the aforementioned data sharing provisions could be found inadmissible due to a lack of voluntary and informed consent.

The HmbBfDI, Johannes Caspar, stated, ''WhatsApp is now used by almost 60 million people in Germany and is by far the most widely used social media application, ahead of Facebook. [Therefore] it is all the more important to ensure that the high number of users, which makes the service attractive to many people, does not lead to the abusive exploitation of data power. Unfortunately, there has not yet been any regulatory review of the actual processing operations between WhatsApp and Facebook that we are aware of.''

The HmbBfDI noted that the aim is for a decision to be made before 15 May 2021 and noted that while the corresponding measures are limited to three months, this can be extended or supplemented by a decision of the European Data Protection Board.

You can read the press release, only available in German, here.