European Union: Issued EDPB binding decision in investigation into WhatsApp's delivery of services compliance with GDPR

On 5 December 2022, the European Data Protection Board (EDPB) adopted its “Binding Decision 5/2022" on the dispute submitted by the Irish SA regarding WhatsApp Ireland Limited (Art. 65 GDPR)”. The Binding Decision relates to the investigation of the Irish Data Protection Commission (DPC) into WhatsApp's delivery of services compliance with the General Data Protection Regulation (GDPR), after receiving a complaint from a German data subject stating that when the GDPR was implemented, WhatsApp required its users to "agree and continue" to its updated Terms of Service to use its services. WhatsApp argued that the users, by accepting the terms, entered into a contract with the company, offering a lawful basis for processing users' data. The complaint contested that this constituted a legal basis for processing data and argued that WhatsApp was "forcing" users to consent to the processing of their personal data. In its Binding Decision, the EDPB concluded that WhatsApp had inappropriately relied on contract to process personal data for the purpose of service improvement and security and therefore lacked the legal basis to process the data. The EDPB concluded that WhatsApp has consequently infringed the GDPR by unlawfully processing personal data. In this context, the EDPB issued several instructions to the DPC for the adoption of its final decision on the basis of the Binding Decision.