WhatsApp faces $267 million GDPR fine over privacy breaches

Meanwhile, WhatsApp has objected to the penalty as disproportionate and said that it would file an appeal.

Ireland’s Data Privacy Commissioner (DPC), the lead data privacy regulator for Facebook within the European Union, had been investigating complaints over how WhatsApp processes user data under Europe’s General Data Protection Regulation (GDPR).

GDPR regulations mandate that entities processing people’s data should be open, clear and transparent with their users. The Irish watchdog found that WhatsApp was in violation of these regulations on data protection rules related to transparency about sharing people’s data with other Facebook companies. 

The DPC also ordered WhatsApp to undertake remedial measures to change the way it communicates with users so that it’s in accordance with with European Union’s regulations.

This is the second and the biggest penalty imposed by the Irish regulator under GDPR. Last year it fined Twitter 450,000 euros for a security breach. It is also the second biggest penalty issued under GDPR after Luxembourg’s 746-million-euro fine to Amazon in July for data protection violations.

A draft of the Irish decision, which reportedly called for a 50-million-euro fine, was shared with regulators in other EU member states to seek their feedback. Subsequently, eight national privacy watchdogs objected, so the case was sent to the EU’s independent oversight body for GDPR, which beefed up the penalty to 225 million euros.

The DPC still conducting two dozen other investigations into big tech companies including Google, Twitter and Facebook, and a second case against WhatsApp.