European Union: Data Protection Commission investigation into WhatsApp’s delivery of services compliance with GDPR

Progress

Current status
in force
12 Jan 2023 in force
05 Dec 2022 under investigation
19 Aug 2022 under investigation
25 May 2018 under deliberation

Scope

Implementers
Austria
Belgium
Bulgaria
Croatia
Cyprus
Czechia
Denmark
Estonia
Finland
France
Germany
Greece
Hungary
Ireland
Italy
Latvia
Lithuania
Luxembourg
Malta
Netherlands
Poland
Portugal
Romania
Slovakia
Slovenia
Spain
Sweden
Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
messaging service provider
Government Branch
executive
Government Body
data protection authority
Implementation Level
national

Timeline of events

12 Jan 2023
in force

Issued DPC ruling in investigation into WhatsApp's delivery of services compliance with GDPR including EUR 5.5 million fine

On 12 January 2022, the Data Protection Commission Ireland (DPC) adopted its final decision in the investigation into WhatsApp's delivery of services compliance with the General Data Protection Regulation (GDPR), issuing a EUR 5.5 million fine. The …

Source
Event type investigation
Action type ruling
Government branch executive
Government body data protection authority
05 Dec 2022
under investigation

Issued EDPB binding decision in investigation into WhatsApp's delivery of services compliance with GDPR

On 5 December 2022, the European Data Protection Board (EDPB) adopted its “Binding Decision 5/2022" on the dispute submitted by the Irish SA regarding WhatsApp Ireland Limited (Art. 65 GDPR)”. The Binding Decision relates to the investigation of the…

Source
Event type investigation
Action type interim ruling
Government branch executive
Government body data protection authority
19 Aug 2022
under investigation

DPC Referred Whatsapp GDPR Compliance case to EDPB

On 19 August 2022, the Irish Data Protection Commission (DPC) referred to the European Data Protection Board the case of WhatsApp’s services compliance with the General Data Protection Regulation (GDPR). Before referring it to the EDPB, the DPC had …

Source
Event type investigation
Action type interim ruling
Government branch executive
Government body data protection authority
25 May 2018
under deliberation

Opened DPC investigation into WhatsApp's delivery of services compliance with GDPR

On 25 May 2018, the Data Protection Commission Ireland (DPC) opened an investigation into WhatsApp's delivery of services compliance with the General Data Protection Regulation (GDPR), after receiving a complaint from a German data subject. The comp…

Source
Event type investigation
Action type announcement
Government branch executive
Government body data protection authority