WhatsApp was ordered to stop sharing personal data with Facebook in November 2016 after the ICO, which opened an investigation into the matter in August that year, said it had concerns that the firm wasn’t being “fully transparent” about the move.
The ICO said on Wednesday that it has completed its investigation, into whether WhatsApp could legally share users’ data with Facebook in the manner the firm was considering.
The short answer? No.
“WhatsApp has not identified a lawful basis of processing for any such sharing of personal data”, information commissioner Elizabeth Denham said, adding that “if they had shared the data, they would have been in contravention of the first and second data protection principles of the Data Protection Act.”
The ICO said WhatsApp had “failed to provide adequate fair processing information to users in relation to any such sharing of personal data”, adding that the sharing of such data “would involve the processing of personal data for a purpose that is incompatible with the purpose for which such data was obtained”.
WhatsApp has agreed to sign an undertaking not to share personal data with Facebook until they can do so in compliance with the upcoming General Data Protection Regulation (GDPR), which comes into force in May this year.
“I reached the conclusion that an undertaking was the most effective regulatory tool for me to use, given the circumstances of the case,” Denham said.
As WhatsApp has agreed not to share data with Facebook, for now at least, the firm has not incurred a financial penalty.
“I compliment WhatsApp in signing this undertaking, which I believe will build trust amongst their many UK users,” added Denham.
“I would also like to stress that signing an undertaking is not the end of story and I will closely monitor WhatsApp’s adherence to it.”