French privacy watchdog CNIL says WhatsApp data transfer to Facebook is illegal

Adjust Comment Print

The instant messaging application has introduced several new features for its users in order to improve their chatting experience - which is good.

The French agency concluded its probe on Monday with the determination that WhatsApp "does not have a legal basis" for sharing data with Facebook.

Commission nationale de l'informatique et des libertés or CNIL has ordered WhatsApp to stop sharing data with its parent company Facebook.

Cnil noted that when WhatsApp was acquired by Facebook in 2014, it released a statement saying it would transfer its user data to Facebook, for three purposes: targeted advertising, security and evaluation, and the improvement of services (business intelligence).

Data was invalidly collected because for two reason: it was not specific to this goal.

Carmelo Anthony: Return to NY will be 'emotional'
NY held on after he left, improving to 15-13 with its third straight victory. I came and did my job whether they liked it or not. Carmelo Anthony is returning to NY .


WhatsApp never told its users that it was collecting data for business intelligence reasons and there's also no possible way to opt out without completely uninstalling the app. CNIL says that this violates "the fundamental freedoms of users". However, this was a problem for the WhatsApp users, and questioned the application's privacy policy. "The company explained that it could not supply the sample requested by the CNIL since, as it is located in the United States, it considers that it is only subject to the legislation of this country".

The Cnil said that while there could be a case to share for the efficient functioning of the application, it wa not the case for the "business intelligence" goal, which aims at improving performances and optimising the use of the application through the analysis of its user behaviour.

As such, the Chair of the CNIL has ordered WhatsApp to bring itself into compliance with the Data Protection Act within one month, and no further action will be taken if the company meets the deadline. That, however, appears to be in violation of the French Data Protection Act.

Earlier, other European regulators have attempted to police Facebook, especially in context to data-sharing.

It mentioned in particular the transfer of data about users such as their phone number and how they use the app as needing specific permission from users. European authorities have tried to stop Facebook from collecting data in the past and Germany went an extra mile to force Facebook to stop data collection.

Comments