Invalid consent declaration: Facebook is not allowed to access WhatsApp data

Facebook may only process the personal data of German WhatsApp users where these users have provided their prior consent in compliance with German data protection law. A decision issued by the Hamburg Administrative Court states that the consent declaration currently used in WhatsApp does not meet these requirements (Hamburg Administrative Court, April 24, 2017, 13 E 5912/16).

According to the decision, it is not transparent to WhatsApp users that by confirming the Terms of Use they are also giving consent to the processing of their personal data by Facebook. Furthermore, in the court’s view, users are not being adequately informed about the exact purpose of the data processing by Facebook.

The court therefore declined to temporarily stay the prohibition order of Hamburg’s Commissioner for Data Protection and Freedom of Information. In September 2016, he prohibited Facebook to process personal data of German WhatsApp users without obtaining effective and informed user consent. In the administrative appeal proceedings, no decision has been made yet.

Practical tip:

Since the decision involved interim relief proceedings, the court could leave open the questions of whether data processing by Facebook must at all meet the requirements of German data protection law and whether German data protection authorities are responsible for orders against Facebook. Neither question has been definitively resolved by the courts to date.