WhatsApp İşlemesinin Hukuki Dayanağı

Binding Decision 5/2022 on the dispute submitted by the
Irish SA regarding WhatsApp Ireland Limited (Art. 65 GDPR)

Adopted on 5 December 2022

Adopted

TABLE OF CONTENTS
1 Summary of the dispute ...................................................................................................5
2 The Right to good administration ......................................................................................8
3 Conditions for adopting a binding decision .........................................................................9
3.1 Objection(s) expressed by CSA(s) in relation to a draft decision .......................................9
3.2 The LSA does not follow the relevant and reasoned objections to the Draft Decision or is of
the opinion that the objections are not relevant or reasoned.................................................. 10
3.3 Admissibility of the case .......................................................................................... 10
3.4 Structure of the binding decision .............................................................................. 11
4 On whether the LSA should have found an infringement for lack of appropriate legal basis ..... 11
4.1 Analysis by the LSA in the Draft Decision.................................................................... 11
4.2 Summary of the objections raised by the CSAs............................................................ 14
4.3 Position of the LSA on the objections ........................................................................ 19
4.4 Analysis of the EDPB ............................................................................................... 21
4.4.1 Assessment of whether the objections were relevant and reasoned ....................... 21
4.4.2 Assessment on the merits................................................................................. 24
5 On the potential additional infringement of the principles of fairness, purpose limitation and
data minimisation ................................................................................................................ 32
5.1 Analysis by the LSA in the Draft Decision.................................................................... 32
5.2 Summary of the objections raised by the CSAs............................................................ 33
5.3 Position of the LSA on the objections ........................................................................ 33
5.4 Analysis of the EDPB ............................................................................................... 34
5.4.1 Assessment of whether the objections were relevant and reasoned ....................... 34
5.4.2 Assessment of the merits ................................................................................. 35
6 On the further investigation ........................................................................................... 39
6.1.1 Analysis by the LSA in the Draft Decision............................................................. 39
6.1.2 Summary of the objections raised by the CSAs..................................................... 41
6.1.3 Position of the LSA on the objections ................................................................. 43
6.1.4 Analysis of the EDPB ........................................................................................ 44
7 On corrective measures other than administrative fines ..................................................... 51
7.1 Analysis by the IE SA in the Draft Decision .................................................................. 51
7.2 Summary of the objections raised by the CSAs............................................................ 51
7.3 Position of the IE SA on the objections ...................................................................... 52
7.4 Analysis of the EDPB ............................................................................................... 52
7.4.1 Assessment of whether the objections were relevant and reasoned ....................... 52

Adopted 2

7.4.2 Assessment on the merits................................................................................. 54
8 On the imposition of an administrative fine ...................................................................... 59
8.1 Analysis by the LSA in the Draft Decision.................................................................... 59
8.2 Summary of the objections raised by the CSAs............................................................ 59
8.3 Position of the LSA on the objections ........................................................................ 60
8.4 Analysis of the EDPB ............................................................................................... 60
8.4.1 Assessment of whether the objections were relevant and reasoned ....................... 60
8.4.2 Assessment on the merits................................................................................. 62
9 Binding Decision ........................................................................................................... 66
10 Final remarks ............................................................................................................ 68

The European Data Protection Board

Having regard to Article 63 and Article 65(1)(a) of the Regulation 2016/679/EU of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(hereinafter “GDPR”) 1 ,
Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended
by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 2 ,
Having regard to Article 11 and Article 22 of its Rules of Procedure (hereinafter “EDPB RoP”) 3 ,

Whereas:
(1) The main role of the European Data Protection Board (hereinafter the “EDPB”) is to ensure the
consistent application of the GDPR throughout the EEA. To this effect, it follows from Article 60 GDPR
that the lead supervisory authority (hereinafter “LSA”) shall cooperate with the other supervisory
authorities concerned (hereinafter “CSAs”) in an endeavour to reach consensus, that the LSA and CSAs
shall exchange all relevant information with each other, and that the LSA shall, without delay,
communicate the relevant information on the matter to the other CSAs. The LSA shall without delay
submit a draft decision to the other CSAs for their opinion and take due account of their views.
(2) Where any of the CSAs expressed a reasoned and relevant objection (“RRO”) on the draft decision
in accordance with Article 4(24) and Article 60(4) GDPR and the LSA does not intend to follow the RRO
or considers that the objection is not reasoned and relevant, the LSA shall submit this matter to the
consistency mechanism referred to in Article 63 GDPR.
(3) Pursuant to Article 65(1)(a) GDPR, the EDPB shall issue a binding decision concerning all the matters
which are the subject of the RROs, in particular whether there is an infringement of the GDPR.

1 OJ L 119, 4.5.2016, p. 1.
2 References to “Member States” made throughout this decision should be understood as references to “EEA
Member States”.
3 EDPB RoP, adopted on 25 May 2018, as last modified and adopted on 6 April 2022.

Adopted 3

(4) The binding decision of the EDPB shall be adopted by a two-thirds majority of the members of the
EDPB, pursuant to Article 65(2) GDPR in conjunction with Article 11(4) of the EDPB RoP, within one
month after the Chair and the competent supervisory authority have decided that the file is complete.
The deadline may be extended by a further month, taking into account the complexity of the subject
matter upon decision of the Chair on own initiative or at the request of at least one third of the
members of the EDPB.
(5) In accordance with Article 65(3) GDPR, if, in spite of such an extension, the EDPB has not been able
to adopt a decision within the timeframe, it shall do so within two weeks following the expiration of
the extension by a simple majority of its members.

(6) In accordance with Article 11(6) EDPB RoP, only the English text of the decision is authentic as it is
the language of the EDPB adoption procedure.

Adopted 4

HAS ADOPTED THE FOLLOWING BINDING DECISION

1 SUMMARY OF THE DISPUTE
1. This document contains a binding decision adopted by the EDPB in accordance with
Article 65(1)(a) GDPR. The decision concerns the dispute arisen following a draft decision (hereinafter
“Draft Decision”) issued by the Irish supervisory authority (“Data Protection Commission", hereinafter
the “IE SA”, also referred to in this document as the LSA) and the subsequent objections expressed by
six CSAs, namely the German Federal Commissioner for Data Protection and Freedom of Information
(“Der Bundesbeauftragter für den Datenschutz und die Informationsfreiheit”) hereinafter the “the
German Federal SA” or the “DE SA”, the Finnish supervisory authority (“Tietosuojavaltuutetun
toimisto”), hereinafter the “FI SA”, the French supervisory authority (“Commission Nationale de
l'Informatique et des Libertés”), hereinafter the “FR SA”, the Italian supervisory authority (“Garante
per la protezione dei dati personali”), hereinafter the “IT SA”, the supervisory authority of the
Netherlands (“Autoriteit Persoonsgegevens”), hereinafter the “NL SA” and the Norwegian supervisory
authority (“Datatilsynet”), hereinafter the “NO SA”.
2. The Draft Decision relates to a “complaint-based inquiry”, which was commenced by the IE SA,
regarding a complaint originally submitted to the Hamburg supervisory authority (“Der Hamburgische
Beauftragte für Datenschutz und Informationsfreiheit”), hereinafter “the DE HH SA“. The case was
subsequently referred to the DE SA, being the relevant supervisory authority, to decide whether
WhatsApp Ireland Limited (hereinafter, “WhatsApp IE”), an online instant messaging platform,
complies with its obligations under the GDPR.

3. The complaint was lodged on 25 May 2018 by a data subject who requested the non-profit noyb –
“European Center for Digital Rights” (hereinafter “NOYB”) to represent her under Article 80(1) GDPR
(both hereinafter referred to as the “Complainant”). It concerned the lawfulness of WhatsApp IE’s
processing of personal data (hereinafter “WhatsApp services”), specifically data processing on foot of
the Complainant’s acceptance of its Terms of Service (and purportedly her acceptance of its Privacy
Policy), and the transparency of information provided by WhatsApp IE to the Complainant about that
processing. The Complainant alleged a violation of the right to data protection and especially a
violation of “Articles 4(11), Article 6(1)(a), Article 7 and/or Article 9(2)(a) of the GDPR” 4 , by arguing that
the controller relied on a “forced consent” 5 . The complaint requested to investigate 6 and to impose
corrective measures 7 . “In the alternative, should the Supervisory Authority not interpret these elements
as consent”, the Complainant takes the position that the controller has no legal basis for the processing
operations “which are not a core element of the instant-messaging service and /or in the interest of
the user (such as advertisement, sponsored content, sharing of information within a group of

4 Complaint, paragraph 2.2.5.
5 Complaint, paragraphs 1.3 and 2.2.5.
6 Within its request to investigate, the Complainant requested that a full investigation be made to determine

“which processing operations the controller engages in, in relation to the personal data of the data subject”, “for
which purpose they are performed”, “on which legal basis for each specific processing operation the controller
relies on”, and to acquire “a copy of any records of processing activities”. The Complainant also requested “that
the results of this investigation [be] made available to [her]”. Complaint, paragraph 3.1.
7 More specifically, the complaint requested in paragraph 3.2 that the competent SA “prohibits all processing

operations that are based on an invalid consent of the data subject”, and in paragraph 3.3 that an “effective,
proportionate and dissuasive fine” be imposed.

Adopted 5

companies analysis and improvement of the controller’s products etc.)”, “since these elements are
clearly not a relevant contractual obligations and no other option under Article 6 of the GDPR seems to
apply in this situation” 8 .
4. Upon receipt of the complaint on 31 May 2018, the IE SA qualified the activities falling within the scope
of the aforementioned complaint as cross-border processing pursuant Article 4(23) GDPR. As the main
establishment of WhatsApp IE (as defined in Article 4(16) GDPR) was found to be in Ireland, the IE SA
was identified as being the LSA, within the meaning of the GDPR, in respect of the cross-border
processing carried out by that company 9 .
5. The following table presents a summary timeline of the events part of the procedure leading to the
submission of the matter to the consistency mechanism:
25 May 2018 The complaint was lodged with the DE HH SA.
The DE-HH SA passed the complaint, for reasons of competence, to
the DE SA. On 31 May 2018, the complaint was passed by the DE SA
to the IE SA.
20 August 2018 The IE SA commenced the inquiry (hereinafter the “inquiry”) and
requested information from WhatsApp IE.
Its scope and legal basis were set out in the Notice of Commencement
of Inquiry that was sent to the Complainant and WhatsApp IE by
letters on 20 August 2018.
On 11 March 2019, WhatsApp IE provided replies to preliminary
queries by the IE SA. Procedural issues, including allegation of bias
were raised by the Complainant by correspondence on 3 December
2018, and subsequent letters from 29 February 2019, 19 April 2019
and 24 February 2020, as well as a phone call on 1 April 2019, that
were addressed by the IE SA.
20 May 2020 The IE SA prepared a Draft Inquiry Report against WhatsApp IE
regarding its processing activities within the scope of the inquiry. The
IE SA invited the Complainant and WhatsApp IE to make submissions
in relation to such draft report.
22 June 2020 WhatsApp IE provided its submissions in relation to the Draft Inquiry
Report.
23 September 2020 The Complainant’s submissions dated 4 September 2020 were
provided to the IE SA by the DE SA.

18 January 2021 The Complainant and WhatsApp IE, as well as the IE SA’s decision
maker, were furnished with a copy of the IE SA’s Final Inquiry Report,
outlining the Investigator’s views, as to whether WhatsApp IE
complied with its obligation under the GDPR.
6 and 7 April 2021 The IE SA commenced the decision-making stage.

23 December 2021 The IE SA issued a preliminary draft decision (hereinafter “the
Preliminary Draft Decision”) against WhatsApp IE, regarding its
processing activities within the scope of the inquiry.

8 Complaint, paragraph 1.3.
9
Schedule to Draft Decision, paragraphs 2.11 to 2.17 (Competence of the Commission) (p. 10-12).

Adopted 6

It was communicated on the same day to the Complainant to enable
them to make observations. The IE SA further attempted to
communicate the Preliminary Draft Decision to WhatsApp IE on this
same date, to enable it to exercise its right to be heard. Having
subsequently discovered that an IT systems’ failure prevented the
Preliminary Draft Decision from reaching WhatsApp IE, the IE SA
shared again the Preliminary Draft Decision with WhatsApp IE on 20
January 2022.
December 2021 – Further exchanges of correspondence took place between the IE SA
February 2022 and the Complainant, addressing translation issues, the scope of the
complaint, as well as allegations that the complete documents had
not been provided.
17 February 2022 WhatsApp IE provided submissions on the Preliminary Draft Decision
to the IE SA.
25 February 2022 The IE SA communicated with Complainant’s’ legal representatives,
confirming that if no further correspondence was received by 1 March
2022, the IE SA would proceed on the basis that the Complainant did
not wish to make submissions. No submissions were received.
1 April 2022 The IE SA shared its Draft Decision with the CSAs in accordance with
Article 60(3) GDPR.
Several CSAs (DE SA, FI SA, FR SA, IT SA, NL SA, and NO SA) raised
objections in accordance with Article 60(4) GDPR.
1 July 2022 The IE SA issued a Composite Response setting out its replies to the
objections raised and shared it with the CSAs (hereinafter,
“Composite Response”).
The IE SA requested that the CSAs consider the responses and
proposals outlined in the Composite Response and confirm whether
they addressed the concerns underlying the objections raised.
1 to 11 July 2022 In light of the proposals in the Composite Response, further
exchanges took place between the IE SA and the CSAs. During the
exchanges, several CSAs (among which the NL SA 10 , the DE SA 11 , the
FI SA 12 and the NO SA 13 ) confirmed to the IE SA that its compromise
proposals were not sufficient and they intended to maintain their
objections.
On 8 July 2022, WhatsApp IE was informed of the upcoming triggering
of the Article 65 GDPR procedure, and was invited to exercise its right
to be heard in respect of all the material that the IE SA proposed to

10 Response of NL SA to IE SA Composite Response Memorandum dated 7 July 2022.
11 Response of DE SA to IE SA Composite Response Memorandum dated 8 July 2022.
12 Response of FI SA to IE SA Composite Response Memorandum dated 8 July 2022.
13 Response of NO SA to IE SA Composite Response Memorandum dated 11 July 2022.

Adopted 7

refer to the EDPB 14 and on 17 August 2022 WhatsApp IE provided its
submissions (hereinafter the “WhatsApp IE Article 65 Submissions”).
19 August 2022 The IE SA referred the matter to the EDPB in accordance with Article
60(4) GDPR, thereby initiating the dispute resolution procedure under
Article 65(1)(a) GDPR.

6. Following the submission by the LSA of this matter to the EDPB in accordance with Article 60(4) GDPR
in the Internal Market Information system (hereinafter, “IMI”) 15 on 19 August 2022, the EDPB
Secretariat assessed the completeness of the file on behalf of the Chair in line with Article 11(2) of the
EDPB RoP.

7. The EDPB Secretariat contacted the IE SA on 23 September 2022, asking for clarifications in relation to
some documents not provided whilst mentioned in Article 11.7 of the EDPB RoP, but mentioned in
other documents. On the same date, the IE SA provided the information requested and confirmed the
completeness of the file.
8. A matter of particular importance that was scrutinized by the EDPB Secretariat was the right to be
heard, as required by Article 41(2)(a) of the EU Charter of Fundamental Rights (hereinafter the “EU
Charter”). Further details on this are provided in Section 2 of this Binding Decision.
9. On 7 October 2022, after the Chair confirmed the completeness of the file, the EDPB Secretariat
circulated the file to the EDPB members.

10. The Chair decided, in compliance with Article 65(3) GDPR in conjunction with Article 11(4) of the EDPB
RoP, to extend the default timeline for adoption of one month by a further month on account of the
complexity of the subject-matter.

2 THE RIGHT TO GOOD ADMINISTRATION
11. The EDPB is subject to EU Charter , in particular Article 41 (the right to good administration). This is
also reflected in Article 11(1) EDPB RoP. Further details were provided in the EDPB Guidelines on Article
65(1)(a) GDPR 16 .
12. The EDPB’s binding decision “shall be reasoned and addressed to the lead supervisory authority and all
the supervisory authorities concerned and binding on them” (Article 65(2) GDPR). It is not aiming to
address directly any third party. However, as a precautionary measure to address the possible need
for the EDPB to offer the right to be heard at the EDPB level to WhatsApp IE, the EDPB assessed if
WhatsApp IE was offered the opportunity to exercise its right to be heard in relation to the procedure
led by the LSA and the subject-matter of the dispute to be resolved by the EDPB. In particular, the
EDPB assessed if all the documents containing the matters of facts and law received and used by the
EDPB to take its decision in this procedure have already been shared previously with WhatsApp IE.

14 The objections, the Composite Response, including the IE SA’s assessment of the relevant and reasoned
objections, as well as the replies of the CSAs.
15 The Internal Market Information (IMI) is the information and communication system mentioned in Article 17

EDPB RoP.
16 See EDPB Guidelines 3/2021 on the application of Article 65(1)(a) GDPR, adopted on 13 April 2021 (version for

public consultation) (hereinafter, “Guidelines on Article65(1)(a), paragraphs 94-108.

Adopted 8

13. The EDPB notes that WhatsApp IE has received the opportunity to exercise its right to be heard
regarding all the documents containing the matters of facts and of law considered by the EDPB in the
context of this decision and provided its written observations 17 , which have been shared with the EDPB
by the LSA 18 .
14. Considering that WhatsApp IE has been already heard by the IE SA on all matters of facts and of law
addressed by the EDPB in its binding decision, the EDPB is satisfied that Article 41 of the EU Charter
has been respected.
15. The EDPB considers that the Complainant is not likely to be adversely affected by this binding decision,
and consequently does not meet the conditions to be granted a right to be heard by the EDPB in line
with Article 41 of the EU Charter, applicable case law, and Article 11 of the EDPB RoP. This is without
prejudice to any right to be heard or other related rights the Complainant may have before the
competent national supervisory authority(/-ies).

3 CONDITIONS FOR ADOPTING A BINDING DECISION
16. The general conditions for the adoption of a binding decision by the EDPB are set forth in Article 60(4)
and Article 65(1)(a) GDPR 19 .

3.1 Objection(s) expressed by CSA(s) in relation to a draft decision
17. The EDPB notes that several CSAs raised objections to the Draft Decision via IMI. The objections were
raised pursuant to Article 60(4) GDPR.
18. More specifically, objections were raised by CSAs in relation to the following matters:

• whether the LSA should have found an infringement for lack of appropriate legal basis;

• the potential additional infringement of the principles of fairness, purpose limitation and data
minimisation;

• on possible further investigation;

• corrective measures other than fines;

• the imposition of an administrative fine.
19. Each of the objections was submitted within the deadline provided by Article 60(4) GDPR.

17WhatsApp IE’s Submissions in relation to the Draft Inquiry Report, dated 22 June 2020.WhatsApp IE’s Response
to Preliminary Draft Decision, dated 17 February 2022.WhatsApp IE Article 65 Submissions, dated 717 August
2022.
18 IN-18-5-6 Memo for Secretariat (Referral of objections to the EDPB pursuant to Article 60(4) and 65(1)(a)

GDPR), 19 August 2022.
19 According to Article 65(1)(a) GDPR, the EDPB will issue a binding decision when a supervisory authority has

raised a relevant and reasoned objection to a draft decision of the LSA and the LSA has not followed the objection
or the LSA has rejected such an objection as being not relevant or reasoned.

Adopted 9

3.2 The LSA does not follow the relevant and reasoned objections to the Draft Decision
or is of the opinion that the objections are not relevant or reasoned
20. On 1 July 2022, the IE SA provided to the CSAs an analysis of the objections raised by the CSAs in the
Composite Response.
21. The IE SA concluded that it would not follow the objections, and in addition, underlined that some of
them are not in its view “relevant” and/or “reasoned”; within the meaning of Article 4(24) GDPR and,
otherwise, for the reasons set out in the Composite Response and below 20 .

3.3 Admissibility of the case
22. The case at issue fulfils, prima facie, all the elements listed by Article 65(1)(a) GDPR, since several CSAs
raised objections to a draft decision of the LSA within the deadline provided by Article 60(4) GDPR, and
the LSA has not followed objections or rejected them, for being in its views, as not relevant or
reasoned.
23. The EDPB takes note of WhatsApp IE’s position that the EDPB should suspend the current Article 65
GDPR dispute resolution due to pending preliminary ruling proceedings before the Court of Justice of
the EU (hereinafter, “CJEU”) 21 . WhatsApp IE refers in particular to cases C-252/21 22 and C-446/2123 .
Following its assessment, the EDPB decides to continue its proceedings on this Article 65 GDPR dispute
resolution, as there is no explicit legal basis for a stay of the dispute resolution procedure in EU law,
nor are existing CJEU rulings on the matter conclusive for the situation of the EDPB 24 . Also, the EDPB
takes into consideration the data subjects’ right to have their complaints handled within a ‘reasonable
period’ (Article 57(1)(f) GDPR), and to have their case handled within a reasonable time by EU bodies
(Article 41 of the EU Charter). Moreover, ultimately there are remedies available to the affected parties
in case of a discrepancy between the EDPB binding decision and CJEU rulings in the aforementioned
cases 25 .
24. Considering the above, in particular that the conditions of Article 65(1)(a) GDPR are met, the EDPB is
competent to adopt a binding decision, which shall concern all the matters which are the subject of

20
Composite Response, paragraphs 36, 74, 78 and 80.
21
WhatsApp IE's Article 65 Submissions, paragraph 2.11.
22 Request for a preliminary ruling of 22 April 2021, Meta Platforms and Others, C-252/21.
23 Request for a preliminary ruling of 20 July 2021, Schrems, C-446/21.

24 Judgment of the CJEU of 28 February 1991, Delimitis, C-234/89, EU:C:1991:91; Judgment of the CJEU of 14

December 2000, Masterfoods, C-344/98, EU:C:2000:689. These cases concerned proceedings before the national
courts, where the parties faced the risk of being confronted with a conflicting decision of the national judge that
could be seen as de facto nullifying the Commission decision – a power which is retained by the CJEU. The current
dispute resolution procedure concerns the adoption of an administrative decision, which can be subject to full
judicial review.
25 In case an action for annulment is brought against the EDPB decision(s) and found admissible, the General

Court/CJEU has the opportunity to invalidate the decision of the EDPB. In addition, and if the General Court/CJEU
were to deliver any judgment in the time between the adoption of the EDPB’s Article 65 decision and the
adoption of the IE SA’s final decision, the IE SA may ultimately decide to revise the final national decision it takes
following the EDPB's binding decision - if the CJEU’s rulings gives cause to do so - in accordance with the principle
of cooperation as elaborated by the CJEU in its judgment of 12 January 2004, Kühne&Heitz NV, C-453/00,
EU:C:2004:17).

Adopted 10

the relevant and reasoned objection(s), (i.e. whether there is an infringement of the GDPR or whether
the envisaged action in relation to the controller or processor complies with the GDPR 26 ).

25. The EDPB recalls that its current binding decision is without any prejudice to any assessments the EDPB
may be called upon to make in other cases, including with the same parties, taking into account the
contents of the relevant draft decision and the objections raised by the CSA(s).

3.4 Structure of the binding decision
26. For each of the objections raised, the EDPB decides on their admissibility, by assessing first whether
they can be considered as a “relevant and reasoned objection” within the meaning of Article 4(24)
GDPR as clarified in the Guidelines on the concept of a relevant and reasoned objection 27 .
27. Where the EDPB finds that an objection does not meet the requirements of Article 4(24) GDPR, the
EDPB does not take any position on the merit of any substantial issues raised by that objection in this
specific case. The EDPB will analyse the merits of the substantial issues raised by all objections it deems
to be relevant and reasoned 28 .

4 ON WHETHER THE LSA SHOULD HAVE FOUND AN INFRINGEMENT
FOR LACK OF APPROPRIATE LEGAL BASIS
4.1 Analysis by the LSA in the Draft Decision
28. The IE SA concludes that the GDPR, the case law and the EDPB Guidelines relevant for the case do not
preclude WhatsApp IE from relying on Article 6(1)(b) GDPR as a legal basis for the processing of users’
data necessary for the provision of its service, including through the improvement of the existing
service and the maintenance of security standards 29 . Finding 2 of the Draft Decision reads 30 “I find the
Complainant’s case is not made out that the GDPR does not permit the reliance by WhatsApp on 6(1)(b)
GDPR in the context of its offering of Terms of Service.” In addition, the IE SA considers the Guidelines
of the EDPB on processing for online services based on Article 6(1)(b) GDPR 31 as being “not strictly
binding, nonetheless instructive in considering this issue” 32 .
29. The IE SA understands the Complainant’s allegations as 33 : firstly, the Complainant was given a binary
choice: i.e. to either accept the Terms of Service and the associated Privacy Policy by selecting the

26
Article 65(1)(a) in fine GDPR. Some CSAs raised comments and not per se objections, which were, therefore,
not taken into account by the EDPB.
27 EDPB Guidelines 9/2020 on the concept of relevant and reasoned objection, version 2 adopted on 9 March

2021 (hereinafter “Guidelines on RRO”). They were adopted on 9 March 2021, after the commencement of the
inquiry by the IE SA relating to this particular case.
28See EDPB Guidelines on Article 65(1)(a), paragraph 63 (“The EDPB will assess, in relation to each objection

raised, whether the objection meets the requirements of Article 4(24) GDPR and, if so, address the merits of the
objection in the binding decision”).
29 Draft Decision, paragraphs 4.49 and 4.50.
30 Draft Decision, Finding 2, p. 32.
31 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the

provision of online services to data subjects, version 2, adopted on 8 October 2019 (hereinafter “Guidelines
2/2019 on Article 6(1)(b) GDPR”).
32 Draft Decision, paragraph 4.22.
33 Draft Decision, paragraph 2.19.

Adopted 11

“accept” button, or cease using the service 34 ; second that there was a lack of clarity on which specific
legal basis WhatsApp IE relies on for each processing operation 35 ; and the Complainant’s concern on
WhatsApp IE’s reliance on Article 6(1)(b) GDPR to deliver its Terms of Service 36 .
30. While the IE SA acknowledges that the EDPB considers in its Guidelines 2/2019 on Article 6(1)(b) GDPR
that, as a general rule, processing for the provision of new services, is not necessary for the
performance of a contract for online service under Article 6(1)(b) GDPR, in this particular case, having
regard to the specific terms of the contract and the nature of the service provided and agreed upon by
the parties, the IE SA concludes that WhatsApp IE may in principle rely on Article 6(1)(b) GDPR as legal
basis of the processing of users’ data necessary for the provision of its service, including through the
improvement of the existing service and the maintenance of security standards 37 . In addition, the IE
SA considers that “issues of interpretation and validity of national contract law are not directly within”
their competence 38 .
31. The IE SA disagrees with what it describes as a “very restrictive view on when processing should be
deemed to be “necessary” for the performance of a contract” proposed by the Complainant and the
EDPB 39 . The IE SA concludes that “core functions” cannot, however, be considered in isolation from
the meaning of “performance”, the meaning of “necessity” as set out in the Draft Decision, and the
content of the specific contract in question 40 . The IE SA considers that Article 6(1)(b) GDPR cannot be
interpreted as requiring that it is impossible to perform the contract without the data processing
operations in question 41 .
32. The IE SA finds it important to have regard not just to the concept of what is “necessary”, but also to
the concept of “performance” of the contract. According to the IE SA, a contract is performed when
each party discharges their contractual obligations as has been agreed by reference to the bargain
struck between the parties. While the IE SA agrees that the mere inclusion of a term in a contract does
not necessarily mean that it is necessary to perform the particular contract, it stresses out that regard
must be had for what is necessary for the performance of the specific contract freely entered into by
the parties 42 .

33. Therefore, the IE SA notes that, the inclusion of a term, which does not relate to the core function of
the contract could not be considered necessary for its performance 43 .

34. For the purposes of identifying the “core” functions of the contract between WhatsApp IE and its users,
the IE SA points out that the Complainant does not specify with any great precision the extent of the
processing (or indeed the processing operation(s)) that the Complainant believes to not be necessary
to perform the Terms of Service). The Complainant has however made some specific submissions
arguing processing for service improvement, security, “exchange of data with affiliated companies”
and that the processing of special categories of personal data is not necessary in order to fulfil the

34 Draft Decision, paragraph 2.8.
35 Draft Decision, paragraph 2.9.
36 Draft Decision, paragraphs 2.9 and 4.9.
37 Draft Decision, paragraph 4.49.
38 Draft Decision, paragraphs 3.13, 4.11, 4.22, 4.39 and 4.44.
39 Draft Decision, paragraph 4.39 and 4.41.
40 Draft Decision, paragraph 4.29.
41 Draft Decision, paragraphs 4.47, 4.49 and 4.50.
42 Draft Decision, paragraph 4.23.
43 Draft Decision, paragraph 4.30.

Adopted 12

“core function” of a messaging and calling service such as the WhatsApp services. As a result, the Draft
Decision focuses on these processing operations 44 .

35. Although according to Guidelines 2/2019 on Article 6(1)(b) GDPR 45 , processing cannot be rendered
lawful by Article 6(1)(b) GDPR “simply because processing is necessary for the controller’s wider
business model”, the IE SA considers that having regard to the specific terms of the contract and the
nature of the service provided and agreed upon by the parties, WhatsApp IE may in principle rely on
Article 6(1)(b) GDPR as a legal basis of the processing of users’ data necessary for the provision of its
service, including services for improvements and security features, insofar as this forms a core part of
the service offered to and accepted by users 46 .

36. Moreover, as described by the IE SA, a distinguishing feature of the WhatsApp IE’s service is that it
regularly monitors its service in order to ensure it functions well (as distinct from the EDPB’s reluctance
expressed in its Guidelines 2/2019 on Article 6(1)(b) GDPR with using data to bring about new services)
and maintains certain security and abuse standards. Therefore, the IE SA concludes that the provision
of this form of service is part of the substance and fundamental object of the contract.
37. The IE SA considers that this information is both clearly set out and publicly available, hence it would
be difficult to argue that this is not part of the mutual expectations of a prospective user and of
WhatsApp IE. Moreover, the IE SA states that the service is advertised as being one that has these
features, and so any reasonable user would expect and understand that this was part of the
agreement, even if users would prefer the market would offer them better alternative choices 47 .
38. Based on the foregoing, the IE SA reaches the conclusion that nothing in Guidelines 2/2019 on Article
6(1)(b) GDPR prevents WhatsApp IE, in principle, from relying on Article 6(1)(b) GDPR for these
purposes 48 .
39. The IE SA thus concludes that WhatsApp IE may in principle rely on Article 6(1)(b) GDPR as a legal basis
of the processing of users’ data necessary on foot of the acceptance of the Terms of Service, including
for regular improvements and maintaining standards of security 49 .
40. The IE SA clarifies that, having regard to the scope of the complaint and its inquiry, the above
conclusion cannot be construed as an indication that all processing operations carried out on users’
personal data are necessarily covered by Article 6(1)(b) GDPR 50 .

41. The IE SA also notes that other provisions of the GDPR, such as those on transparency, act to strictly
regulate the manner in which the WhatsApp IE services are to be delivered and the information that
should be given to users, and decides to address it separately in its Draft Decision 51 .
42. In a separate finding of its Draft Decision 52 , the IE SA reiterates that in a previous inquiry on WhatsApp
IE, an infringement of the GDPR was found as to its compliance with Article 12(1) and Article 13(1)(c)

44 Draft Decision, paragraph 4.32.
45 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 36.
46 Draft Decision, paragraph 4.41.
47 Draft Decision, paragraph 4.42.
48 Draft Decision, paragraph 4.42.
49 Draft Decision, paragraphs 4.47 and 4.49.
50 Draft Decision, paragraph 4.50.
51 Draft Decision, paragraph 4.47.
52 Draft Decision, p. 37, Finding 3.

Adopted 13

GDPR for processing on foot of Article 6(1)(b) GDPR 53 . The IE recalls the general requirement of
transparency under Article 5(a) GDPR 54 , and its previous decision and the associated findings, including
the imposition of a fine and an order to WhatsApp IE to bring its Privacy Policy into compliance 55 .

4.2 Summary of the objections raised by the CSAs
43. The DE SA, FI SA, FR SA, NL SA and NO SA object to Finding 2 of the Draft Decision and the assessment
leading up to it. They consider that the IE SA should have found an infringement of Article 6(1)
GDPR 56 , in line with the EDPB’s interpretation of this provision 57 .
44. In the DE SA’s view, contrary to the IE SA’s submissions in the Draft Decision, WhatsApp IE cannot rely
on Article 6(1)(b) GDPR or any other legal bases of Article 6(1) GDPR for the processing of a user’s
data. According to the DE SA, this constitutes a breach of the principle of lawfulness under Article
5(1)(a) and Article 6(1) GDPR. The DE SA is of the opinion also that the IE SA failed to impose an
appropriate corrective measure in order to remedy these infringements. The DE SA puts forward the
following arguments in support of the above allegations.

45. First, the DE SA does not share the understanding of the IE SA regarding the binding nature of the
Guidelines 2/2019 on Article 6(1)(b) GDPR. The DE SA agrees that guidelines are not legally binding in
the same way as legal provisions are. It recalls however that they are instrumental for establishing
uniform application of EU law according to Article 70(1)(e) GDPR, as well as for ensuring a consistent
and high level of protection for natural persons in the light of recital 10 GDPR. The DE SA claims that
the relevant and binding nature of guidelines for all supervisory authorities as such cannot be disputed.

46. Second, the DE SA disputes the IE SA’s allegations that, on the one hand, the GDPR does not prohibit
WhatsApp IE to rely on Article 6(1)(b) GDPR in connection with its offer of Terms of Service and, on
the other hand, that the LSA is not competent to assess the validity of contracts, respectively the
validity of the Terms of Service or individual clauses. In this regard, the DE SA notes that the IE SA has
full competence according to Article 57(1)(a) GDPR to assess the validity of contracts.
47. Moreover, as stated in the Guidelines 2/2019 on Article 6(1)(b) GDPR, a valid contract is a prerequisite
for controllers to base their processing operations on Article 6(1)(b) GDPR. On that background, the
DE SA points out that in order to monitor the application of Article 6(1)(b) GDPR, as required by Article
57(1)(a) GDPR, the IEA must also verify the validity of the contract WhatsApp IE is relying upon. The
DE SA adds that according to Article 5(2) GDPR, WhatsApp IE must also prove that such a contract has
come into existence, meaning that an offer and corresponding acceptance of a contract is declared by
the parties. In other words, it must be apparent to the contractual partner that they are not giving a
(revocable) consent, but are concluding a contract. If this is not the case, the DE SA considers, as
opposed to the IE SA 58 , that WhatsApp IE cannot rely on the right to choose its own legal basis.

53 IE SA’s decision of 20 August 2021 in inquiry reference IN-18-12-2 (hereinafter “the IE SA’s Decision on
WhatsApp IE’s Transparency”), adopted following EDPB Binding decision 1/2021 on the dispute arisen on the
draft decision of the IE SA regarding WhatsApp IE under Article 65(1)(a) GDPR (hereinafter “EDPB Binding
Decision 1/2021”).
54 Draft Decision, paragraph 5.8.
55 Draft Decision, p aragraph 5.9.
56 DE SA’s Objection, pp. 1-8; FI SA’s Objection, pp. 2-8; NL SA’s Objection, pp. 3-7; NO SA‘s Objection, pp.1-5,

FR SA’s Objection, p. 9.
57 Guidelines 2/2019 on Article 6(1)(b) GDPR.
58 Draft Decision, Issue 3.

Adopted 14

48. Third, the DE SA objects to the IE SA’s finding 59 that the necessity of the processing is determined not
by what is necessary to fulfil the objectives of “a social network“ in a general sense, but what is
necessary to fulfil the core functions of the particular contract between WhatsApp IE and its users.
Those core functions do not encompass the improvements to an existing service and maintaining
certain security and abuse standards. The DE SA stresses out that first WhatsApp IE is not a social
network but a messaging service and that from the perspective of an average data subject, it is not a
distinguishing characteristic of the WhatsApp IE services to improve their service constantly or
maintain certain security standards. Therefore, according to Guidelines 2/2019 on Article 6(1)(b)
GDPR 60 , such processing cannot be rendered lawful by Article 6(1)(b) GDPR simply because the
processing is necessary for the controller’s wider business model. Only the data processing that are
actually necessary for the corresponding contractual purpose – the operation of the WhatsApp IE
Services – can be justified on the basis of Article 6(1)(b) GDPR. In addition, pursuant to Article 32 GDPR,
WhatsApp IE has the obligation to implement data security measures regardless of the content of the
contract, so those measures are not to be considered as an essential element of the contract.
49. The DE SA reiterates that Guidelines 2/2019 on Article 6(1)(b) GDPR explicitly limit the controller’s
possibility to expand the categories of personal data or types of processing operations that are
necessary for the performance of the contract. Based on this, the DE SA concludes that the
interpretation of Article 6(1)(b) GDPR given in the Draft Decision would allow for bypassing the data
protection principles, in particular the requirements for a valid consent, using the Terms of Services.
50. Finally, with regard to the allegation in the Draft Decision that the Complainant did not specify “with
any great precision” which processing operations she believes to be unlawful 61 , the DE SA argues,
referring to Article 77 GDPR, that the Complainant has no obligation to do so. The DE SA takes into
account also that the only source of information about WhatsApp IE’s processing operations is the
publicly available documents that are non-transparent 62 . In the DE SA’s view, it is the duty of
WhatsApp IE to prove compliance in accordance with Article 5(2) GDPR. As a whole, the DE SA
concludes that the processing described or indicated in the Terms of Service cannot be (fully) based
on Article 6(1)(b) GDPR. Moreover, the DE SA considers that there is no other valid legal basis evident.
51. The FI SA objects to the IE SA’s finding 63 that WhatsApp IE can rely on Article 6(1)(b) GDPR for all the
processing operations set out in the Terms of Service, such as service improvements and security
purposes. When it comes to the service improvements and security purposes of processing, the FI SA
refers at the outset to Guidelines 2/2019 on Article 6(1)(b) GDPR 64 in order to justify its allegation that
the processing of data for those purposes is not necessary for performing the key aspects of the
contract and for this reason it cannot be based on Article 6(1)(b) GDPR.

52. The FI SA contests the LSA’s statement that the legal concept of “core” processing falls out of the
interpretation of GDPR 65 . In this respect the FI SA finds that the rationale behind Article 6(1)(b) GDPR
is that it provides a legal basis for situations where processing of personal data will logically need to
take place only in the course of the provisions of a contractual service. Furthermore, in relation to the
IE SA’s allegation that the necessity of processing is to be determined by reference to the particular

59 Draft Decision, paragraph 4.29.
60 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 37.
61 Draft Decision, paragraph 4.32.
62 Draft Decision, Issue 3.
63 Draft Decision, Finding 2, p. 32.
64 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
65 Draft Decision, paragraph 4.11.

Adopted 15

contract, the FI SA highlights that the controller cannot include in the contract everything they wish to
be legitimized under Article 6(1)(b) GDPR, without having for example to ensure that the data subject’s
consent was obtained or to carry out balancing tests between their legitimate interests and the
interests of the data subjects.
53. In addition, referring to Guidelines 2/2019 on Article 6(1)(b) GDPR 66 , the FI SA reaches the conclusion
that neither WhatsApp IE, nor the IE SA in its Draft Decision have properly and objectively reasoned
how the processing of personal data was necessary also from the user´s perspective and not only from
the controller’s side. The FI SA contests the IE SA’s statements that, in general, a reasonable user would
be well-informed about the processing covered by the contract 67 , and that in the specific case the
user is informed about the processing of personal data for service improvements and security
purposes, therefore this processing is part of the mutual expectations of a prospective user and
WhatsApp IE 68 . In addition, while the FI SA admits that service improvements and security might be a
valid part of the WhatsApp IE services, it is of the opinion that processing for those purposes is not
necessary for providing such services, as the WhatsApp IE services could be delivered in the absence
of processing of such personal data. In addition, the FI SA maintains that the said processing activities
are not necessary for the performance of the contract.
54. Next, while the FI SA agrees that there is no hierarchy between legal bases, it points out that it is the
responsibility of the controller to assess which legal basis is appropriate for the specific processing.
When it comes to the IE SA’s argument that EDPB guidelines are not strictly binding 69 the FI SA recalls
that the GDPR itself refers to the EDPB guidelines in its Article 70(1)(e) and therefore stresses the
importance of the common position of supervisory authorities. The FI SA also highlights that the EDPB
shall ensure the consistent application of the GDPR as laid down in Article 70(1) GDPR and enshrined
in recital 10 GDPR.

55. The FR SA objects to the conclusions in Part 4 of the Draft Decision, in particular points 4.47 and 4.49,
that WhatsApp IE has not failed to fulfil its obligations under Article 6 GDPR, and, in addition, that
WhatsApp IE is not required to rely on the legal basis of consent (Article 6(1)(a) GDPR). At the outset,
the FR SA finds questionable the position adopted by the IE SA on WhatsApp IE’s reliance on Article
6(1)(b) GDPR for processing operations related to service improvements. The FR SA notes in this regard
that the Draft Decision does not define what service improvement processing covers and does not
provide enough elements on the categories of data used for service improvement purpose, which does
not allow to pronounce on the applicable legal basis for the processing in question. Therefore, the FR
SA requests that the IE SA completes its Draft Decision on this point, by providing more specific
information and evidence. According to the FR SA, the main reason of the users’ registration to the
WhatsApp services is not the use of their data to improve the messaging service. In the FR SA’s view,
the fact that WhatsApp IE's processing operations for service improvement purpose are based on the
legal basis of the contract, and that it is accepted by a simple validation of the Terms of Service, is not
compliant with the applicable provisions.
56. The FR SA considers that only the legal bases of legitimate interest and consent can be considered for
processing operations related to service improvement purpose among those listed in Article 6 GDPR.
Nevertheless, the FR SA submits that at first analysis, neither the conditions for the application of
consent, nor the conditions for the application of legitimate interest seem to be met and WhatsApp IE

66 Guidelines 2/2019 on 6(1)(b) GDPR, paragraphs 32, 48 and 49.
67 Draft Decision, paragraph 4.36.
68 Draft Decision, paragraph 4.42.
69 Draft Decision, paragraph 4.22.

Adopted 16

could not use it for the implementation of the processing operations in connection with service
improvements. In conclusion, since the IE SA does not define what is covered by the processing of data
for service improvement purpose and the conditions of implementation, it is not easy for the FR SA to
have a firm position on this point and so, on the legal basis that applies for the processing. The FR SA
suggests that the IE SA should provide more specific evidence in its Draft Decision regarding this issue,
in order to assess if the processing can, or cannot, be based on the legal basis of the legitimate interest.
The FR SA states that in reaching the conclusion for lack of breach of Article 6(1) GDPR the LSA erred
in its assessment of the facts of the case.
57. The NL SA first observes that the IE SA failed to include sufficient analysis, evidence and research in its
Draft Decision on what the purposes of processing selected are, and how data are used, making it
difficult to apply Article 6 GDPR 70. The NL SA then questions the validity of the contract between
WhatsApp IE and users, and the NL SA argues that, as a result, grounding the processing on Article
6(1)(b) would be impossible 71 . The NL SA presents the following arguments. First, in the NL SA’s
opinion, the Terms of Service and the Privacy Policy are lengthy and unclear72 . Next, the NL SA notes
that as a general rule, both parties must be aware of the substance of a contract, in order to willingly
enter into it, and considers that ”the established serious lack of transparency on behalf of the
controller, therefore leads to a reasonable doubt whether data subjects have indeed been able to enter
into a contract with the controller both willingly and sufficiently informed” 73 . The NL SA compounds its
doubts on the validity of the contract by arguing that WhatsApp IE presents a completely one-sided
deal whereby an individual data subject has no influence on any of the terms 74 . The NL SA therefore
considers that WhatsApp IE’s statement that it relies on Article 6(1)(b) GDPR for the WhatsApp
services, in combination with documents with general descriptions of the services provided, and the
IE SA’s reference to the controller’s right to choose its own legal basis to process data, are insufficient
to accept that the performance of a contract can be used as a legal basis. Last, due to a lack of insight
in the processing operations and the potential processing of children’s personal data or special
categories of personal data, the NL SA has serious doubts on the validity of such a contract when
children are involved 75 .
58. Further to the foregoing, the NL SA also raises an objection with regard to the IE SA’s approach in its
Draft Decision’s Finding 2. The NL SA deems the approach taken to be contradictory, given the fact the
IEA does not wish to enter into analysis of contract law, while at the same time certain concepts from
contract law are presented, such as “performance” of a contract 76 . The NL SA argues there is a
contradiction in the idea that a clear contract is present, while there are significant transparency issues
at the same time. The NL SA notes that without entering into the specifics of contract law, regard must
be had to the general rule that both parties must be aware of the substance of a contract as well as
the obligations of both parties to the contract, in order to willingly enter into such contract 77 . In the
NL SA’s view, the established serious lack of transparency on behalf of the controller gives rise to
reasonable doubt in this regard 78 .

70 NL SA’s Objection, paragraph 5.
71 NL SA’s Objection, paragraph 10.
72 NL SA’s Objection, paragraph 8.
73 NL SA’s Objection, paragraph 12.
74 NL SA’s Objection, paragraph 10.
75 NL SA’s Objection, paragraph 10.
76 NL SA’s Objection, paragraph 11.
77 NL SA’s Objection, paragraph 12.
78 Draft Decision, p. 31.

Adopted 17

59. Adding to that, the NL SA also notes that a relevant step is to assess whether the concrete data
processing activities that are based on the contract, are actually necessary for performing the key
aspects of the agreement 79 . The NL SA argues that the IE SA has not interpreted the term “necessary”
in Article 6(1)(b) GDPR in line with the EDPB guidance, such as Guideline 2/2019 on Article 6(1)(b)
GDPR, on this provision 80 . The NL SA adds that the IE SA also did not include any substantive
investigation into what data subjects have understood to be the core of the service they have signed
up to and whether they meant to give their consent for the processing of personal data or whether
they intended to conclude an agreement with the controller 81 . In the NL SA’s view, the IE SA did not
conduct a proper assessment on whether all processing operations could be based on a contract and
if not, what other legal basis could be applicable 82 . The NL SA disagrees with the IE SA´s finding that
the criterion of necessity laid down in Article 6(1)(b) GDPR is indirectly impacted by domestic contract
law, since this criterion has an independent meaning in case law and in different EDPB guidelines 83 .
60. The NO SA contests in essence the IE SA’s finding that WhatsApp IE can rely on Article 6(1)(b) GDPR as
a legal basis for processing in the context of service improvements and security features and proposes
imposing respective corrective measures. The NO SA questions whether the processing of personal
data for the purposes of service improvements and security features is genuinely necessary for the
performance of the contract in question. According to the NO SA, the Draft Decision enables
controllers to artificially expand what can fall under Article 6(1)(b) GDPR. In support of the above
objection, the NO SA advances the following arguments.

61. First, the NO SA disagrees with the IE SA’s position that any processing of personal data included in
contractual terms would automatically be lawful if framed in a particular manner. In that context, in
the NO SA’s view, it is not the legislation which sets the boundaries for lawfulness under Article 5(1)(a)
GDPR, but instead the individual contract, which makes the IE SA’s interpretation of Article 6(1)(b)
GDPR incompatible with Article 8 of the EU Charter. Second, the NO SA suggests that Article 6(1)(b)
GDPR should be interpreted in light of its wording, purpose and context. The NO SA considers that
there would always need to be an in concreto assessment of what is necessary for the performance of
the particular contract overall, on a case-by-case basis. The NO SA is of the opinion that the rationale
behind the first alternative of Article 6(1)(b) GDPR is to provide a legal basis for situations where
processing of personal data will logically need to take place in the course of the provision of a
contractual service. In this sense, the NO SA claims that processing of personal data for the purposes
of service improvements and security features as described in the Draft Decision is not a logical
precondition for the messaging service that WhatsApp IE entails. Third, the NO SA believes that the I
E SA’s interpretation of Article 6(1)(b) GDPR has the effect of undermining or circumventing the
other legal bases of Article 6(1) GDPR.
62. With such interpretation, the NO SA finds it hard to foresee when consent under Article 6(1)(a) GDPR
would be relied upon as a legal basis. The same applies to situations invoking Article 9 GDPR. The NO
SA suggests that there would be no use of the legal basis under Article 6(1)(a) and (f) GDPR, because
for the controller is much more convenient to rely on Article 6(1)(b) GDPR. Fourth, according to the
NO SA, Article 7(4) GDPR entails that, if processing of personal data is in fact necessary for the
performance of a contract, then a consent can be considered freely given even if the data subject is
excluded from a service should they decline to give consent. The NO SA considers that under the

79 NL SA’s Objection, paragraph 13.
80 NL SA’s Objection, paragraph 16.
81 NL SA’s Objection, paragraph 13.
82 NL SA’s Objection, paragraph 33.
83 NL SA’s Objection, paragraph 16.

Adopted 18

interpretation put forward by the IE SA, generally almost all processing of personal data by non-public
entities could be framed as being necessary for the performance of a contract, also in the context of
Article 7(4) GDPR. The NO SA alleges that this would render Article 7(4) GDPR meaningless and
without effect in practice, as it would never be invoked. This would, in the NO SA’s view, render the
take-it-or-leave-it consents permissible.

63. The NO SA submits that this lower standard for valid consent would in particular be problematic when
consent serves as a basis for processing of special category of personal data pursuant to Article 9(2)(a)
GDPR, or as a Chapter V GDPR exemption pursuant to Article 49(1)(a) GDPR.

64. Moreover, the NO SA advances the argument that data subjects may be de facto dependent on
certain services and in lack of realistic alternatives to them, in particular due to network effects,
therefore they will generally have little opportunity to negotiate standardised terms of service. This
creates a take-it-or-leave-it situation and an uneven playing field. The NO SA comes to the conclusion
that if rejecting the contractual terms is necessary in order to protect oneself from harm, so that one
is subsequently excluded from the service, participating in discussions, corresponding with others and
receiving information becomes significantly more difficult. As a result, this interpretation could also
adversely affect data subjects’ freedom of expression and information.

4.3 Position of the LSA on the objections
65. The IE SA considers that the objections above are not relevant and/or not reasoned for the purpose of
Article 60(4) GDPR and decides not to follow them 84 .

66. With regard to the objections of the DE SA, FI SA, FR SA, NL SA and NO SA concerning WhatsApp IE’s
possible reliance on Article 6(1)(b) GDPR as the applicable basis for personal data processing, the IE SA
is of the opinion that an assessment of the core functions of the contract in required.
67. The IE SA acknowledges that there are different views on how the “core” elements of the Terms of
Service are assessed, however it considers that it does not adopt a merely formal approach with regard
to Article 6(1)(b) GDPR that relies only on the textual content of the Terms of Service. Moreover, it
considers that an assessment of the core functions of the contract (not merely on the written terms)
is required, pursuant to Article 6(1)(b) GDPR and the requirement for the necessity test 85 .
68. The IE SA considers that WhatsApp IE has not sought to make the WhatsApp services contingent on
the Complainant’s consent to the Terms of Service. Moreover, it does not consider that the test for
contractual necessity under Article 6(1)(b) GDPR would be reduced to an assessment of written
contractual terms, without reference to the fundamental purpose of the contract. The Draft Decision
does not take the view that all written contractual terms are necessary for the performance of a
contract, thus the risks described in this regard are not relevant 86 .
69. The IE SA notes that Article 6(1)(b) GDPR legitimises processing which is necessary for the performance
of a contract (i.e. an agreement which serves the mutual interests of the parties). In addition, it is
considered that a reasonable user would have had sufficient understanding that the service included
the use of metrics for improvement. Accordingly, the IE SA disagrees with the interpretation of “core”
contractual purposes, as suggested by the CSAs, and considers that the Terms of Service properly

84 Composite Response, paragraphs 44, 45, 46, 48, 49, 72 and73.
85
Composite Response, paragraphs 47-48.
86 Composite Response, paragraph 50.

Adopted 19

reflects the agreement entered into by the Complainant, nor does the restrictive interpretation reflect
the purpose of Article 6(1)(b) GDPR 87 .

70. The IE SA states that the guidelines are not binding on supervisory authorities, however, they should
be taken into account. However, the IE SA’s position is that the EDPB has not been provided with the
legal power to mandate that certain categories of processing must be based on consent, to the
exclusion of any other legal bases for processing. The IE SA’s view is that such a power is properly
exercised from time to time by the EU legislator, in the form of specific legislative measures. In
particular, it is noted that Guidelines 2/2019 on Article 6(1)(b) GDPR contain very general observations
to the effect that personal data should not be used “generally” for service improvement pursuant to
Article 6(1)(b) GDPR. The IE SA considers that under these guidelines, processing for service
improvement is not prohibited, pursuant to Article 6 (1)(b) GDPR, so long as it falls within the core or
essential aspects of the service 88 .
71. The IE SA recalls in this regard that the Draft Decision also assesses the core functions of WhatsApp
IE’s Terms of Service 89 . The Draft Decision notes that any application of the principle of necessity must
be specific to the agreement entered into between the parties. The Draft Decision states that
processing should be regarded as necessary for the performance of a contract between the controller
and the data subject if it is necessary to perform the clearly understood objectives of a contract. The
Draft Decision also states that in order to understand the mutual understanding of a contract, it is
necessary to have regard to the specific content of the agreement itself. Having conducted an
assessment of the core or fundamental aspects of WhatsApp IE’s Terms of Service, the Draft Decision
concludes that the nature of the service being offered on this occasion specifically included regular
service improvement including dealing with abuse, as an aspect of the agreement between WhatsApp
IE and its users.
72. The IE SA clarifies that in reaching the above conclusion, it had regard to the expectations of users
based on the specific content of the Terms of Service. The IE concludes on this basis that the processing
should be regarded as necessary for the performance of WhatsApp IE’s Terms of Service. Moreover,
the IE SA adopts the position that the mutual expectations of the parties as to the performance of the
contract should consider the expectations and interests of both parties, as reflected in the contract
itself 90 .
73. The IE SA considers that the EU legislator did not limit the provision of Article 6(1)(b) GDPR only to
processing which is strictly necessary for the delivery of goods and services to a data subject, nor are
the contractual interests of the controller disregarded by this provision. In this regard, the IE SA notes
that contracts may include aspects of performance, which are optional or contingent. In the IE A’s view,
Article 6(1)(b) GDPR is not limited to aspects of contractual performance which are expressly
mandatory and unconditional obligations of the parties. Accordingly, the IE SA is not satisfied that the
ability to opt-out of any particular processing must logically be construed as conclusive evidence that
such processing is not necessary to perform a contract. The IE SA submits that the exercise of options
by a data subject in the context of a contract does not necessarily undermine the agreement entered
into, or the necessity of processing while such options are engaged. The IE SA refers to the CJEU case
C-524/06 91 in support of its finding that necessity in the context of Article 6(1)(b) GDPR cannot be

87 Composite Response, paragraph 59.
88 Composite Response, paragraphs 66 – 69.
89 Draft Decision, paragraph 4.30.
90 Composite Response, paragraph 58.
91 Judgment of 18 December 2008, Heinz Huber v. Bundesrepublik Deutschland, C-524-06, EU:C:2008:724.

Adopted 20

assessed by reference to hypothetical alternative forms of the WhatsApp IE services, as the CJEU has
held in that case that processing which exceeds the most minimal level of processing possible, may be
regarded as necessary, where it renders a lawful objective “more effective”. The IE SA states that it is
not the role of supervisory authorities to impose specific business models on controllers.
74. The IE SA, taking into account the specific facts of this case, considers that WhatsApp IE as a controller
has not attempted to artificially include processing which is not necessary for the fundamental purpose
of its services. The IE SA considers that Guidelines 2/2019 on Article 6(1)(b) GDPR confirm the legal
position, which is that service improvement processing pursuant to Article 6(1)(b) GDPR is not
prohibited per se, as long as it falls within the core or essential aspects of the service.

4.4 Analysis of the EDPB

4.4.1 Assessment of whether the objections were relevant and reasoned
75. The objections raised by the DE SA, FI SA, FR SA, NL SA, and NO SA concern “whether there is an
infringement of the GDPR” 92 . Additionally, the DE SA and NO SA’s objections also concern “whether the
action envisaged in the Draft Decision complies with the GDPR” 93 .

76. The EDPB takes note of WhatsApp IE’s view that not a single objection put forward by the CSAs meets
the threshold of Article 4(24) GDPR 94 . From a general standpoint, WhatsApp IE argues that “to the
extent Objections relate to matters which are outside of the Defined Scope of Inquiry, as identified in
the Draft Decision, they fail to satisfy the requirements of Article 4(24) GDPR and as such are not
“relevant and reasoned”.” 95 . Contrary to WhatsApp IE’s position on relevance 96 , objections can have
bearing on the “specific legal and factual content of the Draft Decision”, despite not aligning with the
scope of the inquiry as defined by an IE SA. Furthermore, the EDPB does not accept WhatsApp IE’s
narrowing the scope of the ”reasoned” criterion to arguments on issues that have been investigated or
addressed in the inquiry 97 , as no such limitation can be read in Article 4(24) GDPR 98 .

77. Contrary to WhatsApp IE’s argument that CSAs may not object to the scope of the inquiry as decided
by the IE SA, the EDPB does not share this reading of Article 65 GDPR. Furthermore, this possibility is
explicitly stated in the RRO Guidelines, especially regarding complaint-based investigations 99 .

92
Guidelines on RRO, paragraph 24.
93
Guidelines on RRO, paragraph 32.
94 WhatsApp IE’s Article 65 Submissions, Annex 1, p. 75-120.
95 WhatsApp IE’s Article 65 Submissions, paragraph 3.3.

96 WhatsApp IE cites the Guidelines on RRO, which state that “[a]n objection should only be considered relevant

if it relates to the specific legal and factual content of the Draft Decision” (paragraph 14) to draw the conclusion
that any objection raising matters outside the scope of the inquiry is not relevant. See WhatsApp's Article 65
Submissions, paragraph 3.3. The EDPB notes that paragraph 14 of the Guidelines on RRO draws a distinction
between relevant objections and “abstract or broad concerns or remarks” on the one hand and “minor
disagreements” on the other. Moreover, this paragraph should be read in conjunction with paragraph 27 of the
Guidelines on RRO.
97 WhatsApp IE’s Article 65 Submissions, paragraph 3.3.
98 Guidelines on RRO, paragraph 16-19.
99 Guidelines on RRO, paragraph 27: “For instance, if the investigation carried out by the LSA unjustifiably fails to

cover some of the issues raised by the complainant or resulting from an infringement reported by a CSA, a relevant
and reasoned objection may be raised based on the failure of the LSA to properly handle the complaint and to
safeguard the rights of the data subject.”

Adopted 21

78. WhatsApp IE also states that “were the EDPB to expand the scope of the Inquiry as set by the DPC at
this stage, in the manner proposed in the Objections, this could not be reconciled with the procedural
requirements of Irish or European Union (“EU”) law, and would infringe WhatsApp IE’s legitimate
expectations, right to fair procedures and due process (including the right to be heard), and rights of the
defence” 100 . Despite claiming it is “clear”, WhatsApp IE does not demonstrate in which manner its
procedural rights would be breached, just by the mere fact that the EDPB finds specific objections
admissible. This is especially questionable, since admissibility determines the competence of the EDPB,
but not the outcome of the dispute between the LSA and the CSAs. Likewise, WhatsApp IE does not
explain how the mere act of considering the merits of admissible objections inevitably and irreparably
breaches the procedural rights cited by WhatsApp IE 101 . Accepting WhatsApp IE’s interpretation would
severely limit the EDPB’s possibility to resolve disputes arising in the one-stop-shop, and thus
undermine the consistent application of the GDPR. The objections of the DE SA, FI SA, FR SA, NL SA, and
NO SA on the finding of an infringement all have a direct connection with the Draft Decision as they
refer to a specific part of the latter, which is Finding 2. All of those objections concern “whether there
is an infringement of the GDPR” as they argue that the IE SA should have found an infringement of
Article 6 GDPR 102 or Article 6(1)(b) GDPR. As the IE SA considered that Article 6(1)(b) GDPR was not
breached, the objections entail a need for a change of the IESA’s Draft Decision leading to a different
conclusion. Consequently, the EDPB finds that the DE SA, FI SA, FR SA, NL SA, and NO SA’s objections
relating to the infringement of Article 6 or Article 6(1)(b) GDPR relevant.

79. The part of the DE SA’s objection arguing that the IE SA should find an infringement of Article 5(1)(a)
GDPR and impose the erasure of unlawfully processed personal data and the ban of the processing of
data, and the part of the NO SA’s objection arguing that the IE SA should order WhatsApp IE to “delete
personal data” and “impose an administrative fine” are linked to the IE SA’s Finding 2 of the Draft
Decision with regard to Article 6(1)(b) GDPR. Therefore, they are directly connected with the substance
of the Draft Decision and, if followed, would lead to a different conclusion, namely a change in this
Finding. Thus, the EDPB considers that these parts of the DE SA and NO SA’s objections are also
relevant.
80. The objections of the DE SA, FI SA, FR SA, NL SA, and NO SA all include arguments on legal/factual
mistakes in the Draft Decision that require amending. More specifically, these CSAs provide arguments
to challenge the Draft Decision’s consideration that WhatsApp IE can rely on Article 6(1)(b) GDPR as a
lawful basis for personal data processing as specified in the Terms of Service 103 . The IE SA held that the
GDPR permits the reliance, by WhatsApp IE, on Article 6(1)(b) GDPR in the context of its offering of
Terms of Service 104 including of users’ data in relation to improvement of the existing service and the
maintenance of security standards 105 . This view is challenged in broad terms as well as in detail. Some
of the CSAs provide arguments challenging the validity of the contract on which the use of Article 6(1)(b)
GDPR as a legal basis depends, and which the IE SA accepts 106 . Some of the CSAs express that of Article

100 WhatsApp IE’s Article 65 Submissions, paragraph 3.13.
101 The EDPB fails to see how, for instance, declaring an objection admissible but rejecting it on the merits could
impinge on the procedural rights of the controller involved in the underlying case.
102 As specified in the objections of the DE SA, FR SA and NL SA.
103 Draft Decision, paragraph 4.
104 Draft Decision, paragraph 4.50.
105 Draft Decision, paragraph 4.49.
106 DE SA’s Objection, pp. 3-4; FI SA’s Objection, paragraphs 21-24 ; NL SA’s Objection, paragraph 26.

Adopted 22

6(1)(b) GDPR as a legal basis cannot be relied upon regarding the purpose of service improvements107
and standards of security 108 .
81. Some CSAs 109 recall, while referring to the terms of Guidelines 2/2019 on Article 6(1)(b) GDPR110 , that
it is the fundamental and mutually understood – by the parties of the contract – contractual purpose,
which justifies that the processing is necessary. This purpose is not only based on the controller’s
perspective but also on a reasonable data subject’s perspective when entering into the contract and
thus on “the mutual perspectives and expectations of the parties to the contract”. The FR SA and the
NO SA 111 disagree with the Draft Decision in that the purposes of service improvement are described
in the Draft Decision in very broad and vague terms, are not a logical precondition for the actual
contractual service of WhatsApp IE and are not the main reason of a user’s registration to the WhatsApp
services. The FI SA adds that most users, including the Complainant, are likely unaware of this
processing of personal data in the context of the WhatsApp IE services 112 .
82. The DE SA, FI SA, FR SA, NL SA, and NO SA’s objections also identify risks posed by the Draft Decision as
drafted in the current manner, in particular the interpretation of Article 6(1)(b) GDPR that could be
invoked by any controller for any processing would undermine or bypass data protection principles 113 ,
would lower the threshold for legality of data processing 114 and thus endanger the rights of data
subjects within the EEA 115 . As an example, the NO SA highlights that ”if it is possible to frame almost
any processing of personal data in contractual terms such that it automatically becomes lawful, as
would be the result pursuant to the [Draft Decision], data subjects would in reality have no control of
their personal data” 116 , while “the FI SA stresses that this would create a significant risk that the
principle of lawfulness and fairness is circumvented” 117 .
83. WhatsApp IE contends that in terms of risk, the objections must ”demonstrate the likelihood of a direct
negative impact of a certain significance of the Draft Decision on fundamental rights and freedoms
under the EU Charter and not just any data subject rights” 118 . WhatsApp IE thus adds a condition to
Article 4(24) GDPR, which is not supported by the GDPR 119 .
84. Considering the objections of the CSAs and the arguments brought forward by WhatsApp IE, the EDPB
finds the objections of the DE SA, FI SA, FR SA, NL SA and NO SAs on the finding of an infringement of
Article 6 or Article 6(1)(b) GDPR reasoned.

107 FI SA’s Objection, paragraphs 21-24 ; FR SA’s Objection, paragraphs 8-16; NO SA’s Objection, pp. 7-8.
108 FI SA’s Objection, paragraph 31; the DE SA’s Objection mentions that security measures are not part of the
contract but a legal obligation under Article 32 GPDR, p. 5.
109 DE SA’s Objection, p.5; FI SA’s Objection, paragraph 31; FR SA’s Objection, paragraph 10; NO SA’s Objection,

p.6.
110 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 32 and 33.
111 FR SA’s Objection, paragraphs 13-14 ; NO SA’s objection, pp.3-4.
112 FI SA’s Objection, paragraph 22.
113 DE SA’s Objection, pp. 7-8.
114 NL SA’s Objection, paragraphs 28-29.
115 FR SA’s Objection, paragraphs 50-51.
116 NO SA’s Objection, p. 8.
117 FI SA’s oObjection, paragraph 33.

118 WhatsApp IE’s Article 65 Submissions, Annex 1, p. 73.
119 Article 1(2) GDPR provides that the GDPR itself “protects fundamental rights and freedoms of natural persons

and in particular their right to protection of personal data”, which directly stems from Article 8(1) of the EU
Charter. Therefore, there is no reason to draw a distinction between the data subject rights protected by the
GDPR and the fundamental rights protected under the EU Charter when interpreting Article 4(24) GDPR.

Adopted 23

85. As regards the parts of the DE SA and NO SA’s objections requesting the finding of an infringement of
Article 5(1)(a) GDPR and specific corrective measures under Article 58 GDPR for the infringement of
Article 6(1)(b) GDPR, the EDPB considers that these parts of the objections do not sufficiently elaborate
the legal or factual arguments that would justify a change in the Draft Decision leading to the finding
of an infringement of Article 5(1)(a) GDPR or to the imposition of the specific corrective measures
mentioned above. Likewise, the significance of the risk for data subjects, which stems from the IE SA’s
Draft Decision not to conclude on the infringement of Article 5(1)(a) GDPR and not to impose the
requested corrective measures, is not sufficiently demonstrated.
86. Considering the above, the EDPB finds that the objections of the DE SA, FI SA, FR SA, NL SA and NO SA
on the finding of an infringement of Article 6 or Article 6(1)(b) GDPR are relevant and reasoned in
accordance with Article 4(24) GDPR.
87. However, the parts of the DE SA and NO SA’s objections concerning the additional infringement of
Article 5(1)(a) GDPR and the imposition of specific corrective measures are not “reasoned” and do not
meet the threshold of Article 4(24) GDPR.

4.4.2 Assessment on the merits
88. In accordance with Article 65(1)(a) GDPR, in the context of a dispute resolution procedure, the EDPB
shall take a binding decision concerning all the matters which are the subject of the relevant and
reasoned objections, in particular whether there is an infringement of the GDPR.
89. Based on the documents transmitted by the IE SA, the EDPB understands that the purposes of the
processing operations covered by these objections are the following: (i) service improvements, and (ii)
“safety and security”. In its Terms of Service, WhatsApp IE refers to its own definition of safety and
security as follows: "We work to protect the safety and security of WhatsApp by appropriately dealing
with abusive people and activity and violations of our Terms. We prohibit misuse of our Services,
harmful conduct towards others, and violations of our Terms and policies, and address situations where
we may be able to help support or protect our community. We develop automated systems to improve
our ability to detect and remove abusive people and activity that may harm our community and the
safety and security of our Services. If we learn of people or activity like this, we will take appropriate
action by removing such people or activity or contacting law enforcement. We share information with
other affiliated companies when we learn of misuse or harmful conduct by someone using our Services."
90. As a preliminary remark, the EDPB notes, as observed by the NL SA, that the purposes are vague,
especially the one on “safety and security”, mentioned by WhatsApp IE in its Terms of Service. The
EDPB understands from the short description provided under the relevant section of WhatsApp IE's
Terms of Service that it refers to “misuse” of WhatsApp services, “harmful conduct”, and activities that
would violate WhatsApp IE’s Terms of Service. In its Draft Decision, the IE SA considered that the
Complainant did not identify particular processing operations with any degree of specificity, and that
complaints should in general have a reasonable degree of specificity, and, hence addressed the issue
of Article 6(1)(b) GDPR in principle. In doing so, the Draft Decision refers to various terms: “abusive
activity” (which is referred to in WhatsApp IE’s Terms of Service) 120 , “fraud” 121 and “security” without
further description 122 (which is referred to in WhatsApp IE’s Terms of Service), which do not bring
clarity and/or more specificity on this purpose. Based on these elements, and considering that
WhatsApp IE’s Terms of Service refer to another purpose of processing than the security carried out

120 Draft Decision, paragraphs 4.36, 4.41, 4.42.
121 Draft Decision, paragraphs 4.38 and 4.49.
122 Draft Decision, paragraphs 4.40, 4.42, 4.47, 4.49.

Adopted 24

by technical and organisational measures in order to secure the processing of personal data, networks
and services or processing to which WhatsApp IE is entitled or obliged under other legal provisions
(e.g. technical and organisational measures applied to protect personal data, for instance as required
under Article 32 GDPR 123 ), the EDPB is excluding “IT Security” from its assessment of the merits
hereinafter. On a similar note, the EDPB highlights that when the purpose of the processing is “IT
Security”, for instance in the meaning of Article 32 GDPR, the purpose of the processing has to be
clearly and specifically identified by the controller 124 .
91. The EDPB considers that the objections found to be relevant and reasoned in this subsection 125 require
an assessment of whether the Draft Decision needs to be changed insofar as it rejects the
Complainant’s claim that the GDPR does not permit WhatsApp IE’s reliance on Article 6(1)(b) GDPR for
the processing operations set out in its Terms of Service. When assessing the merits of the objections
raised, the EDPB also takes into account WhatsApp IE’s position on the objections and its submissions.
92. The CSAs seek in essence to establish whether Article 6(1)(b) GDPR could serve as a valid legal basis
for the processing of personal data at issue, namely for service improvements and security features,
in the specific case and to establish whether there is an infringement of Article 6(1) GDPR.

93. The CJEU has found that so far as concerns the principles relating to lawfulness of processing, Article 6
GDPR sets out an exhaustive and restrictive list of the cases in which processing of personal data can
be regarded as lawful. Thus, in order to be considered lawful, processing must fall within one of the
cases provided for in Article 6 GDPR 126 and it is the controller’s obligation to provide and to be able to
prove that the correct legal basis is applied for the respective processing.
94. The EDPB considers that there is sufficient information in the file for it to decide whether the IE SA
needs to change its Draft Decision insofar as it rejects the Complainant’s claim that the GDPR does not
permit WhatsApp IE’s reliance on Article 6(1)(b) GDPR to process personal data in the context of its
offering of its Terms of Service.
95. As described above, in Section 4.3, the IE SA concludes in Finding 2 of its Draft Decision that the
Complainant’s case is not made out that the GDPR does not permit the reliance by WhatsApp IE on
Article 6(1)(b) GDPR in the context of the latter offering its Terms of Service. Neither Article 6(1)(b)
GDPR nor any other provision of the GDPR precludes WhatsApp IE from relying on Article 6(1)(b) GDPR
as a legal basis to deliver a service, including the improvement of the existing service and the
maintenance of security standards insofar as that forms a core part of the service 127 . The IE SA
considers that, having regard to the specific terms of the contract and the nature of the service
provided and agreed upon by the parties, WhatsApp IE may in principle rely on Article 6(1)(b) GDPR as
a legal basis of the processing of users’ data necessary for the provision of its WhatsApp services, on
foot of the Complainant’s acceptance of the Terms of Service 128 . The IE SA considers that this

123 WhatsApp IE may also fall under legal duties to protect the security of its networks and services, as required
by other laws. See for instance Article 40 of the European Electronic Communications Code established under
Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018.
124 See Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 16.
125 Objections concerning the issue on the applicability of Article 6(1)(b) GDPR for purposes of service

improvement and security features were raised by the DE SA, FI SA, FR SA, NL SA, and NO SA.
126 Judgment of 11 December 2019, Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064,

paragraphs 37 and 38.
127 Draft Decision, paragraph 4.49.
128 Draft Decision, paragraph 4.50.

Adopted 25

information is clearly set out, publicly available and understandable by any reasonable user129 .
WhatsApp IE supports the IE SA’s conclusion 130 .
96. To assess the IE SA and WhatsApp IE’s claims, the EDPB considers it necessary to recall the general
objectives that the GDPR pursues, which must guide its interpretation, together with the wording of
its provisions and its normative context 131 .
97. The GDPR develops the fundamental right to the protection of personal data found in Article 8(1) of
the EU Charter and Article 16(1) of the Treaty on the Functioning of the EU, which constitute EU
primary law 132 . As the CJEU clarified, ”an EU act must be interpreted, as far as possible, in such a way
as not to affect its validity and in conformity with primary law as a whole and, in particular, with the
provisions of the Charter. Thus, if the wording of secondary EU legislation is open to more than one
interpretation, preference should be given to the interpretation which renders the provision consistent
with primary law rather than to the interpretation which leads to its being incompatible with primary
law” 133 . In view of rapid technological developments and increases in the scale of data collection and
sharing, the GDPR creates a strong and more coherent data protection framework in the EU, backed
by strong enforcement, and built on the principle that natural persons should have control over their
own personal data 134 . By ensuring a consistent, homogenous and equivalent high level of protection
throughout the EU, the GDPR seeks to ensure the free movement of personal data within the EU135 .
The GDPR acknowledges that the right to data protection needs to be balanced against other
fundamental rights and freedoms, such as the freedom to conduct a business, in accordance with the
principle of proportionality 136 and has these considerations integrated into its provisions. The GDPR,
pursuant to EU primary law, treats personal data as a fundamental right inherent to data subjects and
their dignity, and not as a commodity, they can trade away through a contract 137 . The CJEU provided
additional interpretative guidance by asserting that the fundamental rights of data subjects to privacy
and the protection of their personal data override, as a rule, a controller’s economic interests 138 .
98. The principle of lawfulness under Article 5(1)(a) and Article 6 GDPR is one of the main safeguards to
the protection of personal data. It follows a restrictive approach whereby a controller may only process
the personal data of individuals if it is able to rely on one of the basis found in the exhaustive and
restrictive lists of the cases in which the processing of data is lawful under Article 6 GDPR 139 .
99. The principle of lawfulness goes hand in hand with the principles of fairness and transparency in Article
5(1)(a) GDPR. The principle of fairness includes, inter alia, recognising the reasonable expectations of

129
Draft Decision, paragraph 4.42.
130
WhatsApp IE’s Article 65 Submission, paragraphs 5.47.
131 Judgment of 1 August 2022, Vyriausioji tarnybinės etikos komisija, C-184/20, ), EU:C:2022:601, paragraph 121.
132 Recitals 1 and 2 GDPR.

133 Judgment of 21 June 2022, Ligue des droits humains v. Conseil des ministres, C-817/19, , EU:C:2022:491,

paragraph 86; and judgment of 2 February 2021, Consob, C-481/19, EU:C:2021:84, paragraph 50 and the case-
law cited.
134 Article 1(1)(2) and recital 6 and 7 GDPR.
135 Article 1(3) and recitals 9, 10 and 13 GDPR.
136 Recital 4 GDPR.
137 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 54.
138 Judgment of 13 May 2014, Google Spain SL, C-131/12, EU:C:2014:317, paragraphs 97 and 99.
139 Judgment of 11 December 2019, TK v Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064,

paragraph 37.

Adopted 26

data subjects, considering possible adverse consequences a processing may have on them, and having
regard to the relationship and potential effects of imbalance between them and the controller 140 .

100. The EDPB agrees with the IE SA and WhatsApp IE that there is no hierarchy between Article 6(1) legal
bases 141 . However, this does not mean that a controller, as WhatsApp IE in the present case, has
absolute discretion to choose the legal basis that suits better its commercial interests. The controller
may only rely on one of the legal bases established under Article 6 GDPR if it is appropriate for the
processing in question 142 . A specific legal basis will be appropriate insofar as the processing can meet
its requirements set by the GDPR 143 and fulfil the objective of the GDPR to protect the fundamental
rights and freedoms of natural persons and in particular their right to the protection of personal data.
A legal basis will not be appropriate if its application to a specific processing defeats this practical effect
“effet utile” pursued by the GDPR and its Article 5(1)(a) and Article 6 GDPR 144 . These criteria stem from
the content of the GDPR 145 and the interpretation favourable to the rights of data subjects to be given
thereto described in paragraph 97 above.
101. The GDPR makes WhatsApp IE, as the controller for the processing at stake, directly responsible for
complying with the GDPR’s principles, including the processing of data in a lawful, fair and transparent
manner, and any obligations derived therefrom 146 . This obligation applies even where the practical
application of GDPR principles such as those of Article 5(1)(a) and Article (5)(2) GDPR are inconvenient
or run counter to the commercial interests of WhatsApp IE. The controller is also obliged to be able to
demonstrate that it meets these principles and any obligations derived therefrom, such as that it meets
the specific conditions applicable to each legal basis 147 . More specifically, this condition to be able to
rely on Article 6(1)(b) GDPR as a legal basis to process the data subject’s data implies that a controller,
in line with its accountability obligations under Article 5(2) GDPR, has to be able to demonstrate that
(a) a contract exists and (b) the contract is valid pursuant to applicable national contract laws 148 .
102. The EDPB agrees that supervisory authorities do not have, under the GDPR, a broad and general
competence in contractual matters. However, the EDPB considers that the supervisory tasks, that the
GDPR bestows on supervisory authorities, imply a limited competence to assess a contract’s general

140 See, recital 39 GDPR and Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 11 and 12.
141
Draft Decision, paragraph 2.9, and WhatsApp IE's Article 65 Submission, paragraph 8.34.
142 As mentioned in Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 18, the identification of the appropriate

lawful basis is tied to the principles of fairness and purpose limitation. It will be difficult for controllers to comply
with these principles if they have not first clearly identified the purposes of the processing, or if the processing
of personal data goes beyond what is necessary for the specified purposes. See also Section 5 below on the
potential additional infringement of the principles of fairness, purpose limitation and data minimisation.
143 Judgment of 11 December 2019, TK v Asociaţia de Proprietari bloc M5A-ScaraA, C-708/18, EU:C:2019:1064,

paragraph 37.
144 Judgment of 18 December 2008, Heinz Huber v. Bundesrepublik Deutschland, C-524-06, EU:C:2008:724,

paragraph 52 on the concept of necessity being interpreted in a manner that fully reflects the objective of
Directive 95/46/EC. On the importance of considering the practical effect (“effet utile”) sought by EU law in its
interpretation, see also for instance: judgment of 21 June 2022, Ligue des droits humains v. Conseil des ministres,
C-817/19, EU:C:2022:491, paragraph 195; and judgment of 17 September 2002, Muñoz and Superior Fruiticola,
C-253/00, EU:C:2002:497, paragraph 30.
145 Article 1(1)(2) and (5) GDPR.
146 Article 5(2) GDPR “Principle of accountability” of controllers; see also Opinion of the Advocate General of 20

September 2022, Meta Platforms e.a., C-252/21, , EU:C:2022:704, paragraph 52.
147 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 26.
148 EDPB Binding decision 2/2022 on the dispute arisen on the draft decision of the IE SA regarding Meta Platforms

Ireland Limited (Instagram) under Article 65(1)(a) GDPR, adopted on 28 July 2022 (hereinafter “EDPB Binding
decision 2/2022”), paragraph 84.

Adopted 27

validity insofar as this is relevant to the fulfilment of their tasks under the GDPR 149 . Otherwise, the
supervisory authorities s would see their monitoring and enforcement task under Article 57(1)(a) GDPR
limited to actions, such as verifying whether the processing at stake is necessary for the performance
of a contract (Article 6(1)(b) GDPR), and whether a contract with a processor under Article 28(3) GDPR
and data importer under Article 46(2) GDPR includes appropriate safeguards pursuant to the GDPR.
103. The DE SA and NL SA 150 argue that the validity of the contract for the WhatsApp services between the
latter and the Complainant is questionable given the serious transparency issues in relation to the legal
basis relied on 151 . In contract law, as a general rule, both parties must be aware of the substance of
the contract and of the obligations of both parties to the contract in order to willingly enter into such
contract.

104. Notwithstanding the possible invalidity of the contract, the EDPB refers to its previous interpretative
guidance on this matter 152 to provide below its analysis on whether the processing for the purposes of
service improvement and security features 153 is objectively necessary for WhatsApp IE to provide its
services to users based on its Terms of Service and the nature of the services.

105. The EDPB recalls 154 that for the assessment of necessity under Article 6(1)(b) GDPR, ”[i]t is important
to determine the exact rationale of the contract, i.e. its substance and fundamental objective, as it is
against this that it will be tested whether the data processing is necessary for its performance” 155 . As
the EDPB has previously stated, regard should be given to the particular aim, purpose, or objective of
the service and, for applicability of Article 6(1)(b) GDPR, it is required that the processing is objectively
necessary for a purpose and integral to the delivery of that contractual service to the data subject 156 .
106. Moreover, the EDPB notes that the controller should be able to justify the necessity of its processing
by reference to the fundamental and mutually understood contractual purpose. This depends not only
on the controller’s perspective, but also on a reasonable data subject’s perspective when entering into
the contract 157 .
107. The IE SA accepts “that, as a general rule, the EPDB considers that processing for the provision of new
services […] would not be necessary for the performance of a contract for online services” 158 . However,
the IE SA considers that in this particular case, having regard to the specific terms of the contract and
the nature of the services provided and agreed upon by the parties, WhatsApp IE may in principle rely
on Article 6(1)b) GDPR to process the user’s data necessary for the provision of its service, including
through the improvement of the existing service and the maintenance of security standards.
108. In particular, the IE SA views service improvement to an existing service and “a commitment to uphold
certain standards relating to abuse, etc.” as a “core” element of the contract between WhatsApp IE

149 EDPB Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraphs 9 and 13.
150 DE SA’s Objection, p.3 ; NL SA’s Objection, paragraph 10.
151 Draft Decision, paragraph 5.9.

152 Guidelines 2/2019 on Article 6(1)(b) GDPR.
153 For the term security, see paragraph 90 of this binding decision.
154 EDPB Binding decision 2/2022, paragraph 89.
155 Article 29 Working Party Opinion 06/2014 on the notion of legitimate interests of the data controller under

Article 7 Directive 95/46/EC, WP 217, adopted on 9 April 2014 (hereinafter, “WP29 Opinion 06/2014 on the
notion of legitimate interests”), p. 17.
156 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 30.
157 EDPB Binding decision 2/2022, paragraph 90.
158 Draft Decision, paragraph 4.49.

Adopted 28

and the users 159 . In support of this consideration, the IE SA refers to the information provided in the
WhatsApp Terms of Service under the headings: “Ways To Improve Our Services.” and “Safety And
Security.” 160 The IE SA considers that it is clear that the WhatsApp services are advertised (and widely
understood) as ones that requires updates and improvement and so, that any reasonable user would
“be well-informed that this is precisely the nature of the service being offered by WhatsApp and
contained within the contract” 161 .
109. The EDPB is of the opinion that WhatsApp IE is under the legal duty to assess whether the processing
of all its users data is necessary for the purpose of service improvements or if there are alternative,
less intrusive ways to pursue this purpose (e.g. instead of relying on all users' data for the purpose of
service improvements, rely on a pool of users, who voluntarily agreed, by providing consent, to the
processing of their personal data for this purpose).
110. On this issue, the EDPB recalls that the concept of necessity has its own independent meaning under
EU law. It must be interpreted in a manner that fully reflects the objective pursued by an EU
instrument, in this case, the GDPR 162 . Accordingly, the concept of necessity under Article 6(1)(b) GDPR
cannot be interpreted in a way that undermines this provision and the GDPR’s general objective of
protecting the right to the protection of personal data 163 or contradicts Article 8 of the EU Charter. On
the processing of data in the WhatsApp services, Advocate General Rantos supports a strict
interpretation of Article 6(1)(b) GDPR among other legal basis, particularly to avoid any circumvention
of the requirement for consent 164 .
111. The EDPB finds that an average user cannot fully grasp what is meant by processing for service
improvement and security features, be aware of its consequences and impact on their rights to privacy
and data protection, and reasonably expect it solely based on WhatsApp IE’s Terms of Service.
Advocate General Rantos expresses similar doubts where he states, in relation to Facebook
behavioural advertising practices, “According to the case-law of the Court of Justice, the processing
must be objectively necessary for the performance of the contract in the sense that there must be no
realistic, less intrusive alternatives, taking into account the reasonable expectations of the data subject.
It also concerns the fact that, where the contract consists of several separate services or elements of a
service that can be performed independently of one another, the applicability of Article 6(1)(b) of the
GDPR should be assessed in the context of each of those services separately” 165 and adds in a footnote
that “Moreover, although merely referencing or mentioning data processing in a contract is not enough
to bring the processing in question within the scope of Article 6(1)(b) of the GDPR, processing may be

159
Draft Decision, paragraph 4.41.
160
Draft Decision, paragraphs 4.34 and 4.35.
161 Draft Decision, paragraph 4.36.

162 See paragraphs 103-105 above on the principles guiding the interpretation of the GDPR and is provisions. The

CJEU also stated in Huber that ”what is at issue is a concept [necessity] which has its own independent meaning
in Community law and which must be interpreted in a manner which fully reflects the objective of that Directive,
[Directive 95/46], as laid down in Article 1(1) thereof”. Judgment of 18 December 2008, Heinz Huber v
Bundesrepublik Deutschland, C-524/06, EU:C:2008:724, paragraph 52.
163 Article 1(2) GDPR.
164 Opinion of the Advocate General of 20 September 2022, Meta Platforms e.a., C-252/21), EU:C:2022:704,

paragraph § 51. The EDPB refers to the Advocate General’s Opinion in its Binding Decision as an authoritative
source of interpretation to underline the EDPB’s reasoning on the processing of data in the Facebook service,
without prejudice to the case-law that the CJEU may create with its future judgments on Cases C-252/21 and C-
446/21.
165 Opinion of the Advocate General of 20 September 2022, Meta Platforms e.a., C-252/21, EU:C:2022:704,

paragraph 54.

Adopted 29

objectively necessary even if not specifically mentioned in the contract, without prejudice to the
controller’s transparency obligations” 166 .

112. The EDPB provides in its guidance 167 assessing what is “necessary” involves a combined, fact-based
assessment of the processing “for the objective pursued and of whether it is less intrusive compared
to other options for achieving the same goal”. If there are realistic, less intrusive alternatives, the
processing is not “necessary”. Article 6(1)(b) GDPR does not cover processing which is useful but not
objectively necessary for performing the contractual service or for taking relevant pre-contractual
steps at the request of the data subject, even if it is necessary for the controller’s other business
purposes. While the possibility of improvements of services may routinely be included in contractual
terms, such processing usually cannot be regarded as being objectively necessary for the performance
of the contract with the user 168 .
113. When analysing the performance of a contract as a legal basis, the necessity requirement has to be
interpreted strictly. As stated earlier by the Article 29 Working Party (hereinafter “WP29”) 169 , this
“provision must be interpreted strictly and does not cover situations where the processing is not
genuinely necessary for the performance of a contract, but rather unilaterally imposed on the data
subject by the controller” 170 .
114. Concerning the processing of service improvement, the EDPB finds that a reasonable user cannot
expect that their personal data is being processed for service improvement simply because WhatsApp
IE briefly refers to this processing in its Terms of Service (which both WhatsApp IE and the IE SA
consider as constituting the entirety of the contract), or because of the argument that “on the basis of
the cont[r]act and wider circumstances, that a reasonable user would have had sufficient
understanding that the service included the use of metrics for improvement” to which the IE SA
refers 171 .
115. In addition, the IE SA already decided 172 that WhatsApp IE infringed its transparency obligations under
Article 5(1)(a), Article 12(1) and Article 13(1)(c) GDPR by not clearly informing the Complainant and
other users of the WhatsApp IE services’ specific processing operations, the personal data processed
in them, the specific purposes they serve, and the legal basis on which each of the processing
operations relies, as the IE SA concludes in its Draft Decision 173 . The EDPB considers that this
fundamental failure of WhatsApp IE to comply with its transparency obligations contradicts the IE SA’s
finding 174 that WhatsApp IE’s users could reasonably expect service improvement and security features
as being necessary for the performance of their contract.

166
Ibid, footnote 165.
167 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 25.
168 Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 49.
169 The WP 29 - the predecessor of the EDPB - was established under Article 29 of Directive 95/46/EC of the

European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the
processing of personal data and on the free movement of such data (“Directive 95/46/EC”) and had a role, inter
alia, to contribute to uniform application of national measures adopted under the Directive. Many of substantive
principles and provisions of the GDPR already existed in the Directive 95/46/EC, such as the one at stake in this
Binding decision, thus WP29 guidance in this respect is relevant for the interpretation of the GDPR.
170 WP29 Opinion 06/2014 on the notion of legitimate interests, p. 16.
171 Composite Response, paragraph 59.
172 Draft Decision, paragraph 5.9.
173 Draft Decision, paragraph 5.9 and Finding 3.
174 Draft Decision, paragraph 4.42.

Adopted 30

116. As regards security, the lack of clarity of the Terms of Service makes it even hard to understand what
are the different purposes pursued and processing carried out 175 .

117. The EDPB recalls that “controllers should make sure to avoid any confusion as to what the applicable
legal basis is” and that this is “particularly relevant where the appropriate legal basis is Article 6(1)(b)
GDPR and a contract regarding online services is entered into by data subjects”, because “[d]epending
on the circumstances, data subjects may erroneously get the impression that they are giving their
consent in line with Article 6(1)(a) GDPR when signing a contract or accepting terms of service”176 .
Article 6(1)(b) GDPR requires the existence of a contract, its validity, and the processing being
necessary to perform it. These conditions cannot be met where one of the parties (in this case a data
subject) is not provided with sufficient information to know that they are signing a contract, the
processing of personal data that it involves, for which specific purposes and on which legal basis, and
how this processing is necessary to perform the services delivered. For the purposes of service
improvement and security features, WhatsApp IE has not relied on any other legal basis to process
personal data. These transparency requirements are not only an additional and separate obligation,
but also an indispensable and constitutive part of the legal basis.
118. Given that the main purpose for which a user uses the WhatsApp services is to communicate with
others, and that WhatsApp IE conditions their use to the user’s acceptance of a contract and the service
improvement and security 177 features they include, the EDPB cannot see how a user would have the
possibility of opting out of a particular processing which is part of the contract. Thus, WhatsApp IE is
accountable to prove that the legal basis applied for the processing at hand is valid and the failure to
demonstrate this proves that Article 6(1) GDPR is not the applicable legal basis.

119. The EDPB agrees with the DE SA, FI SA, FR SA, NL SA and NO SA 178 that there is a risk that the Draft
Decision’s failure to establish WhatsApp IE’s infringement of Article 6(1)(b) GDPR, pursuant to its
interpretation by the IE SA, nullifies this provision and makes theoretically lawful any collection and
reuse of personal data in connection with the performance of a contract with a data subject. WhatsApp
IE currently leaves the Complainant and other users of the WhatsApp services with a “take it or leave
it” choice. They may either contract away their right to freely determine the processing of their
personal data and submit to its processing for service improvements or security features, which they
can neither expect, nor fully understand based on the insufficient information WhatsApp IE provides
to them. Alternatively, they may decline accepting WhatsApp IE’s Terms of Service and thus be
excluded from a service that enables them to communicate with millions of users.
120. This precedent could encourage other economic operators to use the contractual performance legal
basis of Article 6(1)(b) GDPR for all their processing of personal data. There would be the risk that some
controllers argue some connection between the processing of the personal data of their consumers
and the contract to collect, retain and process as much personal data from their users as possible and
advance their economic interests at the expense of the safeguards for data subjects. Some of the
safeguards from which data subjects would be deprived due to an inappropriate use of Article 6(1)(b)
GDPR as legal basis, instead of others such as consent under Article 6(1)(a) GDPR and legitimate
interest under Article 6(1)(f) GDPR, are the possibility to specifically consent to certain processing

175 For the meaning of the term “security”, see paragraph 90 above.
176
EDPB Binding Decision 01/2021, paragraph 214, and Guidelines 2/2019 on Article 6(1)(b) GDPR, paragraph 20.
177 For the meaning of the term “security”, see paragraph 90 above.
178 DE SA’s Objections – p. 6, paragraph 2 and p. 8, paragraph 1; FI SA’s Objections – p. 7, paragraphs 32 and 33 ;

FR SA’s Objections – paragraph 14 ; NL SA’s Objections – paragraphs 8 and 28; NO SA’s Objections – p. 4,
paragraph 3.

Adopted 31

operations and not to others and to the further processing of their personal data (Article 6(4) GDPR);
their freedom to withdraw consent (Article 7 GDPR); their right to be forgotten (Article 17 GDPR); and
the balancing exercise of the legitimate interests of the controller against their interests or
fundamental rights and freedoms (Article 6(1)(f) GDPR).
121. The EDPB thus concurs with the objections of the DE SA, FI SA, FR SA, NL SA and NO SA 179 to Finding 2
of the Draft Decision in that the processing for the purposes of service improvements and security180
features performed by WhatsApp IE are objectively not necessary for the performance of WhatsApp
IE’s alleged contract with its users and are not an essential or core element of such contract.
122. In conclusion, the EDPB decides that WhatsApp IE has inappropriately relied on Article 6(1)(b) GDPR
to process the Complainant’s personal data for the purpose of service improvement and security181
features in the context of its Terms of Service and therefore lacks a legal basis to process these data.
The EDPB was not required to examine whether data processing for such purposes could be based on
other legal bases because the controller relied solely on Article 6 (1) (b) GDPR. WhatsApp IE has
consequently infringed Article 6(1) GDPR by unlawfully processing personal data. The EDPB instructs
the IE SA to alter its Finding 2 of its Draft Decision which concludes that WhatsApp IE may rely on
Article 6(1)(b) GDPR in the context of its offering of Terms of Service and to include an infringement of
Article 6(1) GDPR based on the shortcomings that the EDPB has identified.

5 ON THE POTENTIAL ADDITIONAL INFRINGEMENT OF THE
PRINCIPLES OF FAIRNESS, PURPOSE LIMITATION AND DATA
MINIMISATION
5.1 Analysis by the LSA in the Draft Decision
123. In light of the aforementioned inquiry’s scope, the Draft Decision mentions Article 5(1) GDPR in several
passages 182 . As for the fairness principle, the inquiry consists of reference to the unfair processing
pointed out by the Complainant 183 . Regarding the purpose limitation and data minimisation principles,
there are no other references as the ones mentioned above. The Draft Decision makes several
references to Article 5(1)(a) GDPR and the principle of transparency 184 . However, the Draft Decision
does not address whether Article 5(1)(a) GDPR regarding fairness principle or Article 5(1)(b) and (c)
GDPR have been infringed. In its Draft Decision, the IE SA mentions its Decision on WhatsApp IE’s
Transparency, which made findings to the effect that transparency obligations were infringed.
Therefore, the IE SA concludes, that “The inquiry in question focused on the same issues raised in the
herein Complaint insofar as transparency is concerned (although was much broader in scope). Given
these issues have already been investigated and adjudicated on by the Commission, I provisionally find
that the transparency issues raised in this Complaint have already been addressed.” 185

179
DE SA’s Objections – p. 5, paragraphs 3 and 4; ; FI SA’s Objections – p. 6, paragraph 24; FR SA’s Objections –
p. 7, paragraph 38 ; NL SA’s Objections – paragraph 26; NO SA’s Objections - p. 8.
180 For the meaning of the term “security”, see paragraph 90 above.

181 For the meaning of the term “security”, see paragraph 90 above.
182 See, for example, Draft Decision, Section 5, paragraphs 5.1, 5.7 and 5.8.
183 Complaint, paragraphs 2.3.1. and 2.3.2.
184 Draft Decision, Section 5, paragraphs 5.8 and 5.9.
185 Draft Decision, Section 5, paragraphs 5.9 and 5.10.

Adopted 32

5.2 Summary of the objections raised by the CSAs
124. The IT SA raises an objection arguing that the Draft Decision should be amended to include findings of
an infringement of Article 5(1)(a) GDPR in relation to the fairness principle. This objection claims that,
even though there is the IE SA’s Decision on WhatsApp IE’s Transparency, which incorporates the
principle set out in the EDPB’s Binding Decision 1/2021 and where an infringement of transparency
principle was to be found, the infringement regarding to the fairness principle should be separate from
transparency. The IT SA elaborates that referring to Article 6(1)(b) GDPR should not be found to be in
line with the fairness principle, as users are factually unable to grasp how their personal data is being
used by WhatsApp IE 186 .
125. The IT SA raises another objection stating that the Draft Decision should be amended to include
findings of infringement of Article 5(1)(b) and (c) GDPR. The IT SA is of the view that the fact that
WhatsApp IE’s “(multifarious) processing activities involving personal data are grounded in Article
6(1)(b) GDPR entails an infringement of purpose limitation and data minimization principles” 187 . The
IT SA states that the IE SA has failed to investigate compliance with Article 5(1)(b) and (c) GDPR.
Further, the IT SA states that all the purposes of the processing of personal data performed under the
terms of Article 6(1)(b) GDPR must be specified and communicated to data subjects. As such, the
service that WhatsApp IE offers pursues several purposes, therefore the applicability of Article 6(1)(b)
GDPR should be assessed separately in the context of each service. The IT SA elaborates that the
purposes provided to users are inadequate and have no connection to the processing activities.

5.3 Position of the LSA on the objections
126. The final position of the IE SA is that of not following these objections. in its Composite Response,
concerning all objections, the IE SA notes that the objections on the fairness principle in Article 5(1)(a)
GDPR are not in the scope of the underlying complaint 188 . Furthermore, the IE SA states that this would
procedurally constrain the IE SA’s ability to adopt its final decision 189 .
127. In addition, the IE SA states that it would also risk breaching the controller’s right to a fair procedure,
as the controller was not afforded a right to be heard on such matter. The IE SA highlights the legal
consequences that would flow from making material changes concerning infringements outside of the
complaint and Draft Decision, namely the likelihood that WhatsApp IE would succeed in arguing before
the Irish courts that it has been denied an opportunity to be heard on additional and extraneous
findings that are adverse to it 190 .

128. The IE SA further considers that the objection raised by the IT SA with regard to the possible
infringement of Article 5(1)(b) and (c) GDPR is not relevant and reasoned, since it would not have been
appropriate to undertake an open-ended assessment of all processing operations by the controller in
order to handle the complaint 191 . This would have resulted in a disproportionate and open-ended
examination of the processing carried out by WhatsApp IE. Therefore, it was more important to resolve
the fundamental dispute regarding the interpretation of Article 6(1) GDPR first 192 .

186 IT SA’s Objection, paragraph 3, pages 8-10.
187 IT SA’s Objection, page 6.
188 Composite Response, paragraphs 28 and 29.
189 Ibid., paragraph 29.
190 Composite Response, paragraphs 28 to 32.
191 IT SA’s Objection, paragraph 2.

192 Composite Response, paragraph 25.

Adopted 33

5.4 Analysis of the EDPB

5.4.1 Assessment of whether the objections were relevant and reasoned
129. The IT SA’s objection concerns “whether there is an infringement of the GDPR” 193 .
130. The EDPB takes note that WhatsApp IE agrees with the IE SA’s conclusion in its Composite Response
that the objection from the IT SA about finding an infringement of Article 5(1)(a) GDPR also with regard
to non-conformity with respect to the fairness principle is not relevant. In addition, WhatsApp IE
submits that the objection does not meet the “reasoned” threshold as it is not based on any detailed
factual or legal reasoning and fails to address the significance of the alleged risks to fundamental rights
posed by the Draft Decision 194 . According to WhatsApp IE, “it would be inappropriate for the EDPB to
direct the [IE SA] to make any findings in respect of Article 5(1)(a) (fairness of lawfulness) in its final
decision in the Inquiry in circumstances where this is outside the Defined Scope of Inquiry.” 195
131. In addition to the above mentioned, the Complainant does note: “Even if a trained lawyer reads all the
text that the controller provides, he/she can only guess what data is processed, for which exact purpose
and on which legal basis. This is inherently non-transparent and unfair within the meaning of Articles
5(1)(a) and 13(c). This approach therefore stands in clear contrast to informed consent or any form of
“plain language” or even “easy to understand” requirements (Recital 39).” 196
132. WhatsApp IE also affirms that compliance with Article 5(1)(a) GDPR is distinct from compliance with
Article 6(1) GDPR and must be separately assessed before any finding of infringement could be
made 197 .
133. The EDPB recalls that an objection could go as far as identifying gaps in the draft decision justifying the
need for further investigation by the IE SA, for example in situations where the investigation carried
out by the IE SA unjustifiably fails to cover some of the issues raised by the Complainant 198 . In this
regard, the EDPB observes that, in the complaint, the Complainant alleges that the information
provided in WhatsApp IE’s Privacy Policy “is inherently non-transparent and unfair within the meaning
of Articles 5(1)(a) and 13(c)” 199 . This is also noted by the IE SA 200 .
134. As previously mentioned, the EDPB notes that the first objection of the IT SA concerns “whether there
is an infringement of the GDPR” as it argues that the IE SA should have found an infringement of the
fairness principle under Article 5(1)(a) GDPR. As such objection demonstrates that, if followed, it would
lead to a different conclusion as to whether there is an infringement of the GDPR or not, the objection
is to be considered as “relevant” 201 .
135. In addition, this objection is also considered to be “reasoned” since it puts forward several factual and
legal arguments for the proposed change in legal assessment. The additional infringement stems from

193 Guidelines on RRO, paragraph 24.
194 WhatsApp IE’s Article 65 Submissions, pp. 107-109.
195 Ibid., p. 31.
196 Complaint, paragraph 2.3.1.
197 WhatsApp IE’s Article 65 Submissions paragraph. 4.25.
198 Guidelines on RRO, paragraph 27.
199 Complaint, p. 14.
200 Draft Decision, paragraph 5.7.

201 Guidelines on RRO, paragraph 13.

Adopted 34

the scope and findings of the Draft Decision, which also mentions Article 5(1)(a) GDPR 202 , and the
overarching nature of Article 5(1)(a) GDPR.
136. Additionally, the EDPB finds that the objection of the IT SA clearly demonstrates the significance of the
risks posed by the Draft Decision to the fundamental rights and freedoms of data subjects, since it
would create a dangerous precedent that would jeopardize the effective protection of data subjects
and thus entail flawed corrective actions.
137. The EDPB considers the objection on Article 5(1)(a) GDPR to be adequately reasoned and recalls that
the assessment of merits of the objection is made separately, after it has been established that the
objection satisfies the requirements of Article 4(24) GDPR 203 .

138. Although the second objection of the IT SA, relating to the additional infringements of the purpose
limitation principle under Article 5(1)(b) GDPR and the data minimisation principle under Article 5(1)(c)
GDPR, is relevant and includes justifications concerning why and how issuing a decision with the
changes proposed in the objection is needed and how the change would lead to a different conclusion
in the Draft Decision, it does not satisfy all the requirements stipulated by Article 4(24) GDPR. In
particular, the objection raised does not explicitly motivate why the Draft Decision itself, if left
unchanged, would present risks for the fundamental rights and freedoms of data subjects. In addition,
the EDPB notes that the IT SA’s objection does not explicitly elaborate why such a risk is substantial
and plausible 204 . Therefore, the EDPB concludes that this particular objection of the IT SA does not
provide a clear demonstration of the risks as specifically required by Article 4(24) GDPR.

5.4.2 Assessment of the merits
139. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether there is
an infringement of the GDPR.
140. The EDPB considers that the objection found to be relevant and reasoned in this subsection requires
an assessment of whether the Draft Decision needs to be changed insofar as it contains no finding of
infringement of the fairness principle under Article 5(1)(a) GDPR. When assessing the merits of the
objection raised, the EDPB also takes into account WhatsApp IE’s position on the objection and its
submissions, focussed on arguing that the IT SA objection is not relevant and reasoned, rather than on
the content.

141. Before proceeding with the assessment of the merits, the EDPB recalls that the basic principles relating
to processing listed in Article 5 GDPR can, as such, be infringed 205 . This is apparent from the text of
Article 83(5)(a) GDPR which subjects the infringement of the basic principles for processing to
administrative fines of up to 20 000 000 EUR, or in the case of an undertaking, of up to 4% of the total
worldwide annual turnover of the preceding financial year, whichever is higher.

142. At first, the EDPB notes that the concept of fairness is not defined as such in the GDPR. However, recital
39 GDPR provides some elements as to its meaning and effect in the context of processing of personal

202 The Objection refers to paragraph 5.7 of the Draft Decision.
203 Guidelines on Art. 65(1)(a), paragraph 63 (“The EDPB will assess, in relation to each objection raised, whether
the objection meets the requirements of Article 4(24) GDPR and, if so, address the merits of the objection in the
binding decision.”).
204 Guidelines on RRO, paragraph 37.
205 Binding decision 1/2021, paragraph 191.

Adopted 35

data. An important aspect of the principle of fairness under Article 5(1) GDPR, which is linked to recital
39, is that data subjects should be able to determine in advance what the scope and consequences of
the processing entails and that they should not be taken by surprise at a later point about the ways in
which their personal data have been used 206 .
143. Fairness is an overarching principle, which requires that personal data shall not be processed in a way
that is unjustifiably detrimental, unlawfully discriminatory, unexpected or misleading to the data
subject. Measures and safeguards implementing the principle of fairness also support the rights and
freedoms of data subjects, specifically the right to information (transparency), the right to intervene
(access, erasure, data portability, rectification) and the right to limit the processing (right not to be
subject to automated individual decision-making and non-discrimination of data subjects in such
processing) 207 .
144. The principles of fair and transparent processing require that the data subject shall be informed of the
existence of the processing operation and its purposes. The controller should provide the data subject
with any further information necessary to ensure fair and transparent processing taking into account
the specific circumstances and context in which the personal data are processed. Furthermore, the
data subject should be informed of the existence of profiling and the consequences of such profiling208 .
145. The EDPB underlines that the principles of fairness, lawfulness and transparency, all three enshrined
in Article 5(1)(a) GDPR, are three distinct but intrinsically linked and interdependent principles that
every controller should respect when processing personal data. The link between these principles is
evident from a number of GDPR provisions: recitals 39 and 42, Article 6(2) and Article 6(3)(b) GDPR
refer to lawful and fair processing, while recitals 60 and 71 GDPR, as well as Article 13(2), Article 14(2)
and Article 40(2)(a) GDPR refer to fair and transparent processing.

146. The IT SA states that “the infringement of Article 5(1)(a) GDPR should be found by the LSA in the case
at hand by having also regard to the more general fairness principle, which entails separate
requirements from those relating specifically to transparency.” 209
147. There is no dispute that in its Decision on WhatsApp IE’s Transparency, the IE SA found a breach of the
transparency principle, but the EDPB considers that the principle of fairness has an independent
meaning and stresses that an assessment of WhatsApp IE’s compliance with the principle of
transparency does not automatically rule out the need for an assessment of WhatsApp IE’s compliance
with the principle of fairness too.

148. The EDPB recalls that, in data protection law, the concept of fairness stems from the EU Charter210 .
The EDPB has already provided some elements as to the meaning and effect of the principle of fairness
in the context of processing personal data. For example, the EDPB has previously opined in its
Guidelines on Data Protection by Design and by Default that “Fairness is an overarching principle which
requires that personal data should not be processed in a way that is unjustifiably detrimental,

206 WP29 Guidelines on transparency under Regulation 2016/679, paragraph 10.
207 EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, Version 2, Adopted on 20
October 2020, hereinafter “Guidelines on Data Protection by Design and by Default”).
208 Recital 60 GDPR.
209 IT SA’s Objection, paragraph 3, p. 9.
210 Article 8 of the EU Charter states as follows: “1. Everyone has the right to the protection of personal data

concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent
of the person concerned or some other legitimate basis laid down by law” (emphasis added).

Adopted 36

unlawfully discriminatory, unexpected or misleading to the data subject” 211 . Among the key fairness
elements that controllers should consider in this regard, the EDPB mentions autonomy of the data
subjects, data subjects’ expectation, power balance, avoidance of deception, ethical and truthful
processing 212 . These elements are particularly relevant in the case at hand. The principle of fairness
under Article 5(1)(a) GDPR underpins the entire data protection framework and seeks to address
power asymmetries between controllers and data subjects in order to cancel out the negative effects
of such asymmetries and ensure the effective exercise of data subjects’ rights.
149. The EDPB has previously explained that “the principle of fairness includes, inter alia, recognising the
reasonable expectations of the data subjects, considering possible adverse consequences processing
may have on them, and having regard to the relationship and potential effects of imbalance between
them and the controller” 213 . The EDPB recalls that a fair balance must be struck between, on the one
hand, the commercial interests of controllers and, on the other hand, the rights and expectations of
data subjects under the GDPR 214 . A key aspect of compliance with the principle of fairness under Article
5(1)(a) GDPR refers to pursuing “power balance” as a “key objective of the controller-data subject
relationship” 215 , especially in the context of online services provided without monetary payment,
where users are often not aware of the ways and extent to which their personal data is being
processed 216 . Consequently, if data subjects are not enabled to determine what is done with their
personal data, this is in contrast with the element of “autonomy” of data subjects as to the control of
the processing of their personal data 217 .
150. Considering the constantly increasing economic value of personal data in the digital environment, it is
particularly important to ensure that data subjects are protected from any form of abuse and
deception, intentional or not, which would result in the unjustified loss of control over their personal
data. Compliance by providers of online services acting as controllers with all three of the cumulative
requirements under Article 5(1)(a) GDPR, taking into account the particular service that is being
provided and the characteristics of their users, serves as a shield from the danger of abuse and
deception, especially in situations of power asymmetries. Therefore, the EDPB disagrees with the IE
SA’s finding that assessing WhatsApp IE’s compliance with the principle of fairness “would therefore
not only represent a significant departure from the scope of inquiry, as formulated, but it would also
risk breaching the controller’s right to a fair procedure, as regards any matter which was never put to

211 EDPB 4/2019 Guidelines on Article 25, Data Protection by Design and by Default, version 2, adopted on 20
October 2022, (hereinafter “Guidelines on Data Protection by Design and by Default”) paragraph 69 .
212 Guidelines on Data Protection by Design and by Default, paragraph 70.
213 Guidelines on Article 65(1)(a), paragraph 12.

214 On the balance between the different interests at stake see for example: Judgment of 12 December 2013, X,

C-486/12, EU:C:2013:836; Judgment of 7 May 2009, College van burgemeester en wethouders van Rotterdam v
M. E. E. Rijkeboer, C-553/07, EU:C:2009:293; Judgment of 9 November 2010 in joined cases, Volker und Markus
Schecke GbR, C-92/09, and Hartmut Eifert,C-93/09, v Land Hessen, EU:C:2010:662.
215 Guidelines on Data Protection by Design and by Default, paragraph 70.
216 On “online services”, see Guidelines 1/2019 on Article 6(1)(b) GDPR, paragraphs 3-5.
217 Guidelines on Data Protection by Design and by Default, paragraph 70. According to this element of fairness,

“data subjects should be granted the highest degree of autonomy possible to determine the use made of their
personal data, as well as over the scope and conditions of that use or processing”.

Adopted 37

the complainant during the course of inquiry.” 218 In addition, it is important to note that WhatsApp IE
has been heard on the objections and therefore submitted written submissions on this matter 219 .
151. The EDPB has previously emphasised that the identification of the appropriate lawful basis is tied to
the principles of fairness and purpose limitation 220 . In this regard, the IT SA rightly observes that while
finding a breach of transparency relates to the way in which information has been provided to users
via the terms of service and the Privacy Policy, compliance with the principle of fairness also relates to
‘how the controller addressed the lawfulness of the processing activities in connection with its calling
and messaging service’ 221 . Thus, the EDPB considers that an assessment of compliance by WhatsApp
IE with the principle of fairness requires also an assessment of the consequences that the choice and
presentation of the legal basis entail for the WhatsApp services’ users. In addition, that assessment
cannot be made in the abstract, but has to take into account the specificities of the particular
messaging service and of the processing of personal data carried out, namely for purposes related to
improvements of the messaging service 222 .
152. The EDPB notes that in this particular case, the Complainant was forced to consent to the Terms of
Service and the Privacy Policy 223 and this clearly impacts the reasonable expectations of WhatsApp IE’s
users by confusing them on whether clicking the ”Accept” button results in giving their consent to the
processing of their personal data. The EDPB notes in this regard that one of the elements of compliance
with the principle of fairness is avoiding deception (i.e. providing information “in an objective and
neutral way, avoiding any deceptive or manipulative language or design” 224 ).
153. As the IE SA itself notes, the Complainant argues that WhatsApp IE relied on ”forced consent” for the
processing simply because it did in fact believe that the controller was relying on the legal basis of
consent for that processing 225 . The Complainant presents the screenshot, aiming to demonstrate that,
“the data subject was presented with an easy click to quickly consent, and to return to the service.”226
The EDPB keeps in mind that in the complaint, this was explained in the context of arguing that consent
was forced. Therefore, the EDPB shares the IT SA’s concern that WhatsApp IE misrepresented the legal
basis of the processing and that WhatsApp IE’s users are left ”in the dark” as to the possible
connections between the purposes sought, the applicable legal basis and the relevant processing
activities 227 . This being said, the EDPB considers that the processing by WhatsApp IE cannot be
regarded as ethical and truthful 228 because it is confusing with regard to the type of data processed,

218
Composite Response, paragraph 30.
219
WhatsApp IE’s Article 65 Submissions, Category 1f: “The DPC should also make findings that WhatsApp
Ireland infringed the fairness principle under Article 5(1)(a) GDPR / lawfulness principle under Article 5(1)(a)
GDPR“, p. 31.
220 Guidelines 1/2019 on Article 6(1)(b) GDPR, paragraph 1.
221 IT SA’s Objection, p. 9.
222 Draft Decision, paragraph 4.40.

223 See paragraph 3 above.
224 Guidelines on Data Protection by Design and by Default, paragraph 70.
225 Draft Decision, paragraph 5.7.
226 Complaint, p. 5.
227 IT SA’s Objection, p. 9.
228 Guidelines on Data Protection by Design and by Default, paragraph 70, where the EDPB explains that “ethical”

means that “The controller should see the processing’s wider impact on individuals’ rights and
dignity“ and “truthful” means that “The controller must make available information about how they process
personal data, they should act as they declare they will and not mislead the data subjects”.

Adopted 38

the legal basis used and the purposes of the processing, which ultimately restricts the WhatsApp IE’s
users’ possibility to exercise their data subjects’ rights.

154. Considering the seriousness of WhatsApp IE’s misrepresentation on the legal basis relied on identified
in the current Binding decision 229 , the EDPB agrees with the IT SA that WhatsApp IE has presented its
service to its users in a misleading manner 230 , which adversely affects their control over the processing
of their personal data and the exercise of their data subjects' rights.
155. This is all the more supported by the fact that the circumstances of the present case as demonstrated
above 231 and the infringement of Article 6(1)(b) GDPR 232 further intensify the imbalanced nature of the
relationship between WhatsApp IE and its users brought up by the IT SA’s objection.

156. The combination of factors, such as the unbalanced relationship between WhatsApp IE and its users,
combined with the “take it or leave it” situation that they are facing due to the lack of alternative
services in the market and the lack of options allowing them to adjust or opt out from a particular
processing under their contract with WhatsApp IE, systematically disadvantages them, limits their
control over the processing of their personal data and undermines the exercise of their rights under
Chapter III GDPR.

157. Therefore, the EDPB instructs the IE SA to include a finding of an infringement of the principle of
fairness under Article 5(1)(a) GDPR by WhatsApp IE and to adopt the appropriate corrective measures,
by addressing, but without being limited to, the question of an administrative fine for this infringement
as provided for in Section 8 of this Binding decision.

6 ON THE FURTHER INVESTIGATION
6.1.1 Analysis by the LSA in the Draft Decision
158. According to the claim 233 made in the complaint, data subjects have to “agree to” WhatsApp IE’s Terms
of Service and Privacy Policy at the time of the update that was made to the documents in April 2018.
The IE SA considers that it is necessary to recognise the difference between agreeing to a contract and
providing consent to personal data processing specifically for the purposes of complying with the
GDPR. The IE SA elaborates 234 that WhatsApp IE does not rely on consent in order to process data on
foot of the Terms of Service, nor it is legally required to do so, thus reliance on Article 7 GDPR is not
applicable, regarding the subject matter of the complaint and will not be a subject to further
consideration.

159. In its Draft Decision, the IE SA concludes that arguments on the applicability of Article 6(1)(b) GDPR as
a legal basis for data processing to facilitate (behavioural) advertising “are not relevant to the within
inquiry” 235 , given the absence of references, related to advertising or sponsored content in WhatsApp
IE’s Terms of Service, and the absence of evidence that such processing takes place.

229 See, paragraph 117 above.
230 IT SA Objection, page 9.
231 Draft Decision, paragraphs148-153.
232 Draft Decision, paragraphs 117 and 122.
233 Draft Decision, paragraph 3.11.
234 Draft Decision, paragraph 3.19.
235 Draft Decision, paragraph 4.8.

Adopted 39

160. Another consideration made by the IE SA is related to the data processing related to “exchange of data
with affiliated companies” and the processing of special categories of data, namely:
1) The IE SA considers that there is no evidence 236 for the assertion that WhatsApp IE is
processing data that facilitates the inferring of special categories of personal data,
pertaining to religious views, sexual orientation, political views and health status. Further,
as stated, no evidence is presented in this regard at all, thus a conclusion is made that the
processing of special categories of data pursuant to Article 9 GDPR, does not fall within the
scope of the complaint and is thus irrelevant.
2) In its Draft Decision, the IE SA notes that a distinguished feature of WhatsApp IE is the
regular monitoring of its service, in order to ensure its well-functioning, as well as
maintaining a security 237 and abuse standards (both being part of the substance and
fundamental object of the contract). Thus, WhatsApp IE could rely on Article 6(1)(b) GDPR
as a legal basis for such processing in principle. Further 238 , the IE SA considers that it is not
for an authority such as it, tasked with the enforcement of data protection law, to make
assessments as to what will or will not make the performance of a contract possible or
impossible. Instead, the general principles set out in the GDPR and explained by the EDPB
in the Guidance must be applied. These principles should be applied on a case-by-case
basis, and should be afforded more weight than generalised examples provided in the
Guidance, which are helpful and instructive but are by no means absolute or conclusive.
3) The IE SA states that it is clear from the Terms of Service 239 that “any sharing with affiliated
companies forms part of the general “improvements” that are carried out pursuant to
Article 6(1)(b) GDPR” and “sharing of WhatsApp user data to Meta Companies takes place
on a controller to processor basis only, there does not need to be a distinct legal basis
supporting it (or assessment of this issue in the Inquiry)”. Moreover, in its view, there is not
an explicit prohibition envisaged in Guidelines 2/2019 on Article 6(1)(b) GDPR related to
the processing of personal data that is necessary to fulfil a contractual term that commits
to improving the functionality, efficiency, etc. of an existing service. Further, the IE SA
states that the core of the service, as outlined in the specific contract with the data subject,
clearly includes those services. In its view, the processing is necessary to deliver the service
offered (as set out in the Terms of Service).

161. The IE SA supports the conclusions made above by reference to the following:
162. The IE SA 240 begins by pointing out that it is important to distinguish between agreeing to a contract
that might involve personal data processing, and the provision of consent to personal data processing
specifically for legitimising the said data processing under the GDPR. It should also be noted that there
are differences between the legal bases for processing under Article 6(1)(a) and (b) GDPR. The IE SA
continues that in many such cases involving a contract between a consumer and an organisation, the
lawful basis for processing of personal data is “the necessity for the performance of a contract” under
Article 6(1)(b) GDPR.

236 Draft Decision, paragraph 4.33; Draft Decision Schedule, paragraphs 3.29, 3.30 and 3.31.
237 For the meaning of the term security, see paragraph 90 of this binding decision.
238 Draft Decision, paragraph 4.45
239 Draft Decision, paragraph 4.33, as well as paragraphs 4.36 to 4.43.
240 Draft Decision, paragraphs 3.11 to 3.17.

Adopted 40

163. The IE SA states that the GDPR does not set out any form of hierarchy of lawful bases that can be used
for processing personal data, whether by reference to the categories of personal data or otherwise.
Moreover, Article 7 GDPR (as relied on by the Complainant) concerns the conditions for consent and
is relevant when considerations are made regarding whether particular criteria are met, in order to
ensure that the consent is lawful. The aforementioned provision is not indicative of which lawful basis
the controller has to rely on, but instead assists the latter to determine whether the conditions of
validity are met. Therefore, the IE SA thus considers that Article 7 GDPR is not applicable to the subject
matter raised by the Complainant.
164. The IE SA considers that no evidence was presented whatsoever by the Complainant that WhatsApp
IE processes personal data for the purpose of advertising and that it relies on Article 6(1)(b) GDPR to
do so 241 . In addition, the IE SA takes note that WhatsApp IE’s Terms of Service are not similar to the
examples of situations, cited in the complaint, where Article 6(1)(b) GDPR does not apply, namely for
advertising and sponsored consent. The IE SA concludes that arguments related to the applicability of
Article 6(1)(b) GDPR for data processing that facilitates advertising, are not relevant.
165. In addition, as outlined in the Schedule to the Draft Decision 242 , the assertions about WhatsApp IE’s
alleged ability to infer religious views, sexual orientation, political views and health status are not
backed with any evidence on the Complainant’s part. The IE SA concludes 243 that there is no evidence
that WhatsApp IE processes special categories of personal data at all, thus the question of processing
such data does not fall within the scope of the inquiry at all.
166. Moreover, according to the IE SA, it is evident 244 from the Terms of Service that any sharing with
affiliated companies forms part of the general “improvements” that are carried out pursuant to Article
6(1)(b) GDPR, and so in reality any clear delineation between these two forms of processing would be
artificial. It needs to be pointed out that one aspect of the aforementioned sharing is the possible
reception of messages for the purposes of direct marketing and, in particular, “an offer for something
that might interest” 245 the respective user.
167. The Complainant, however, argues 246 that such improvements and security features, as referenced,
and the associated sharing of data with other Meta Companies (then Facebook Companies), is not
necessary in order to deliver a messaging service, and that simply placing these terms in the contract
does not make them necessary. Although those statements might be true, according to the IE SA it
does not follow that fulfilling these terms is not necessary in order to fulfil the specific contract with
WhatsApp IE. The IE SA adds that to do that, to use the language of the EDPB, it is necessary to consider
“the nature of the service being offered to the data subject”.

6.1.2 Summary of the objections raised by the CSAs
168. The FI SA, FR SA and IT SA object to the conclusions reached by the IE SA in its Draft Decision, requesting
the IE SA to further investigate the matters of behavioural advertising, special categories of personal
data, the provision of metrics to third parties, including to companies belonging to the same group,
and marketing.

241 Draft Decision, paragraph 4.8.
242
Schedule to Draft Decision, paragraphs 3.29 and 3.30.
243 Schedule to Draft Decision, paragraph 4.33.
244 Draft Decision, paragraphs 4.33 and 4.41.
245 Draft Decision, paragraph 2.11 (“Ways To Improve Our Services”).
246 Draft Decision, paragraph 4.36.

Adopted 41

169. On behavioural advertising, in the FR SA’s view 247 , the Draft Decision does not include an analysis for
the applicable legal basis for the processing of personal data, related to behavioural advertising, as it
considers that neither the Complainant, nor WhatsApp IE’s general Terms and Conditions provide any
evidence that personal data are processed for that purpose. It also notes that this exclusion is not
justified by other elements such as investigation reports or the sending of questionnaires by the IE SA.
Moreover, the FR SA 248 is of an opinion that the IE SA should have carried out an investigation in order
to verify whether or not the WhatsApp IE processes personal data for the purposes of behavioural
advertising.
170. On special categories of personal data, the FR SA argues 249 that the Draft Decision does not pronounce
on the lawfulness ground that is applicable with regard to the processing of special categories of
personal data, even though the complaint does. In addition, together with examining whether the
conditions are met in the present case for the processing of special categories of personal data
pursuant to Article 9(2) GDPR, the IE SA should have carried out the investigations necessary, in order
to verify whether such processing is actually taking place.
171. The IT SA opines 250 that the processing of special categories of personal data relating to users that
participate in chats with business users relying on a third-party provider (which might be WhatsApp
IE’s controlling company Meta) should have been identified as a specific processing activity to be
assessed and evaluated separately by the IE SA. In addition, the IT SA considers that no in-depth
assessment has been carried out in this regard, but instead that the IE SA simply endorses WhatsApp
IE’s statement that all communications are encrypted.
172. On the provision of metrics to third parties, including to affiliated companies, the FR SA argues that
the Draft Decision 251 does not pronounce on the applicable legal basis for such processing, despite
mentioned initially in the complaint. It continues that the IE SA has not defined which activities are
covered under such processing. Therefore, the FR SA requests the IE SA to complete its Draft Decision
in this regard. In addition, the FR SA requests that the conditions for the application of the other legal
bases mentioned in Article 6 GDPR, namely consent, contract and legitimate interest are examined, as
well. Hence, the FR SA considers, that WhatsApp IE cannot rely on the aforementioned legal bases for
processing for the purposes provision of metrics to third parties.

173. The IT SA notes 252 that the arguments put forward by the IE SA regarding the joint assessment of
processing for service improvement purposes and the exchange of data with affiliated companies, is
neither convincing, nor exhaustive. The IT SA is of the view that the IE SA should have identified and
separately assessed the processing activities in question without “pooling” them into the service
improvement category. Moreover, the exact wording used in WhatsApp IE’s Terms of Service includes
“affiliated companies”, “partners” and “service providers”, which are, in the IT SA’s view, unspecified,
meaning that the exchange of personal data between them could “hardly fall within the intra-group
communications between WhatsApp and the other Meta companies and could be legitimised as a
controller-processor relationship.” The IT SA argues that the IE SA could have identified and separately
assessed the legal basis for the said exchange of data with partners and third-party service providers.
In addition, in the light of the complaint, the IT SA notes that data are exchanged with affiliated

247 FR SA’s Objection, paragraph 6.
248
FR SA’s Objection, paragraph 7.
249 FR SA’s Objection, paragraph 33.
250 IT SA’s Objection, paragraph 3.a.
251 FR SA’s Objection, paragraphs 35 to 45.
252 IT SA’s Objection, paragraph 3.b.

Adopted 42

companies not only for service improvement purposes, but also for unspecified ones, related to the
management and provision of the WhatsApp services. The IT SA stresses on the need for further
investigation on this matter.
174. On marketing, the FI SA takes note 253 that the Draft Decision contains conclusions that WhatsApp IE
may rely on Article 6(1)(b) GDPR as a legal basis in the context of its Terms of Service and, more
precisely, for the processing for the purposes set out there, including marketing. Further, the FI SA
opines that an assessment is needed in order to determine whether WhatsApp IE has a relevant legal
basis for processing personal data for marketing purposes 254 . The FI SA argues that, provided that there
is an indication in WhatsApp IE’s Terms of Service that a user might receive marketing messages, the
IE SA should have carried out an investigation in this regard 255 .

6.1.3 Position of the LSA on the objections
175. The IE SA states that it does not propose to “follow” 256 the objections raised by the CSAs.
176. In the light of the suggestions made by some of the CSAs 257 that the scope of the inquiry ought to have
considered additional factual matters, such as behavioural advertising, the IE SA notes that a
complaint-based inquiry has been conducted. The IE SA considers that a requirement, from a CSA, to
amend the Draft Decision in order to include findings of infringement(s) that fall outside of the scope
of the complaint would constrain its ability to adopt its final decision. Moreover, the IE SA stresses out
that WhatsApp IE has already been informed about the scope of the complaint. The IE SA notes, in this
regard, that the right to be heard is exercised in response to a particularized allegation of wrongdoing,
and WhatsApp IE was not informed of an allegation of infringement relating to these additional
matters 258 . In the IE SA’s opinion, an amendment would prevent the controller’s right to a fair
procedure and hinder its right to be heard.
177. With regard to the processing of special categories of personal data and the assessment made by the
IE SA, the latter concludes that the reference to such processing by WhatsApp IE must be read as an
element of the Complainant’s fundamental allegation (i.e. that the agreement to the Terms of Service
was a form of GDPR consent to processing of personal data, including consent to the processing of
special categories of data). In circumstances, where the scope of the inquiry has addressed the
fundamental issue of principle on which the complaint depends, the IE SA is satisfied that it is not
necessary to also conduct an indiscriminate and open-ended assessment of the processing by
WhatsApp IE that may otherwise fall within the scope of Article 9 GDPR.

178. Moreover, regarding the statements made by the FR SA 259 , the IE SA contends that it is unclear of the
basis on which the former makes its assumptions, and adds that the matter has already been
considered in the Schedule to the Draft Decision.

179. In addition, having conducted an assessment of the core functions of WhatsApp IE’s Terms of Service,
the IE SA concludes that the nature of the WhatsApp services offered includes regular service
improvement as an aspect of the agreement concluded between WhatsApp IE and the respective user,

253 FI SA’s Objection, paragraph 3.
254 FI SA’s Objection, paragraph 9.
255 FI SA’s Objection, paragraph 10.
256 Composite Response, paragraph 36.
257 Composite Response, paragraphs 28 to 30.
258 Composite Response, paragraphs 30-35.
259 Composite Response, paragraph 34 (“No consideration of Article 9 GDPR is present in the Draft Decision.”).

Adopted 43

thus the basis of the processing is to be regarded as necessary for the performance of the
contract 260 .However, the IE SA further notes 261 , contracts may include aspects of performance which
are optional or contingent. For example, most of the processing carried out by WhatsApp IE, which
relates to communication between users is optional for users, as a user is not obliged to send messages
to other users (for example). Such processing is nevertheless directly linked to the core “messaging
service” function; it would appear to be uncontroversial that such processing is necessary for the
performance of the Terms of Service, as a type of mutually expected processing. At the same time, this
processing is optional and not indispensable, and the Terms of Service can otherwise be performed
without any messages being sent by a user. According to the IE SA, this reflects the fact the Article
6(1)(b) GDPR is not limited to aspects of contractual performance which are expressly mandatory and
unconditional obligations of the parties.
180. Regarding the issue 262 related to WhatsApp IE’s controllership and its relationship with the other Meta
companies, and the degree of investigation carried out, the IE SA contends that it “has nothing further
to add in this regard”.

6.1.4 Analysis of the EDPB
6.1.4.1 Assessment of whether the objections were relevant and reasoned

181. In this section, the EDPB considers whether the objections raised by the FI SA, FR SA and IT SA,
regarding the need for a further investigation, meet the threshold of Article 4(24) GDPR.
182. WhatsApp IE considers that the objections made by the aforementioned CSAs are without merit.

183. In essence, WhatsApp IE argues that the FR SA’s objection raises concerns with regard to behavioural
advertising that are not connected to any factual content and do not have any merit, because, as
confirmed before to the IE SA, WhatsApp IE does not engage in such processing 263 . Moreover,
WhatsApp IE considers 264 that the IE SA appropriately addressed this matter in its Draft Decision, given
the vague nature of the complaint, the misconceptions regarding WhatsApp services, and the lack of
evidence that such processing is taking place. WhatsApp IE that no factual or legal arguments are put
forward by the FR SA.

184. Furthermore, the EDPB takes note of WhatsApp IE’s position on the objection raised by the FR SA with
regard to the processing of special categories of data, according to which they are based on a
“misunderstanding of the Defined Scope of Inquiry”, as well as the nature of the service offered and
they “fail to take into account the investigations conducted by the [IE SA]” 265 . Further, WhatsApp IE
emphasises that it does not process special categories of data in the course of providing the WhatsApp
services. Moreover, it is of the view 266 that the FR SA does not acknowledge that the processing in
question has already been addressed by the IE SA in its Draft Decision, concluding that there is no

260 Composite Response, paragraphs 57 and 59.
261 Composite Response, paragraph 61.
262 Composite Response, paragraphs 84 and 85.
263 WhatsApp IE’s Article. 65 Submissions, paragraph 4.27.
264 WhatsApp IE’s Article 65 Submissions, Annex 1, Section 1.a, paragraph 6.a.
265 WhatsApp IE’s Article 65 Submissions, paragraph 4.3.
266 WhatsApp IE’s Article 65 Submissions, Section 1.a, paragraph 6.g.

Adopted 44

evidence that it was taking place and that it is irrelevant to the complaint and the inquiry. Thus, for
WhatsApp IE, the FR SA’s objection raised is neither relevant, nor reasoned 267 .

185. With regard to the FR SA’s objection 268 regarding the legal basis for provisions of metrics to third
parties and the need for a further investigation, WhatsApp IE states that it does not rely on Article
6(1)(b) GDPR as a legal basis for the processing. Further, the processing for metrics purposes is carried
out on a controller-to-processor basis in order to assist WhatsApp IE in processing what forms part “of
the general ‘improvements’”. WhatsApp IE adds that there is no requirement present to have a distinct
legal basis for such sharing. It states that “the provision of the WhatsApp Service does not involve any
sharing of EU WhatsApp users’ personal data with other Meta Companies on a controller to controller
basis”. Furthermore, WhatsApp IE argues that the IT SA’s objection 269 on the investigation of further
sharing carried out by WhatsApp IE with “unspecified partners and service providers” is not relevant to
the issues investigated by the IE SA, nor does it have connection to the substance of the complaint or
the Draft Decision. Moreover, WhatsApp IE considers that it is not clear what “exchange of data” was
referred to by the IT SA and its relevance to the inquiry. Thus, WhatsApp IE opines that the IT SA’s
objection should be rejected.

186. Finally, with regard to the FI SA’s objection 270 , WhatsApp IE argues that the FI SA’s statement, regarding
the reliance on Article 6(1)(b) GDPR for processing for marketing purposes is irrelevant and falls outside
of the defined scope of the inquiry. Further, WhatsApp IE points out that the specific reference to the
Terms of Service is misunderstood, as it is related to potential marketing messages that users might
receive from businesses that use the services offered by WhatsApp IE. Finally, WhatsApp IE considers
that since businesses use WhatsApp Business API for exchanging messages (with their own terms and
privacy policies), it is not the controller in respect of those processing operations.

***

187. As regards the objection of the FR SA, arguing that the IE SA did not analyse the applicable legal basis
for the processing of personal data related to behavioural advertising, the EDPB establishes that it has
a direct connection with the Draft Decision. The EDPB considers that the FR SA’s objection is relevant
and, if followed, would lead to a different conclusion. It includes arguments on factual and legal
mistakes in the IE SA’s Draft Decision that require amendments, for which it is considered reasoned.
More specifically, the FR SA’s objection alleges that the IE SA should have carried out an investigation
in order to verify whether or not WhatsApp IE processes personal data for the purposes of behavioural
advertising.

188. As regards the risks posed by the Draft Decision, the EDPB takes note of the FR SA’s remark that the
position of the IE SA would incur a risk for the fundamental rights and freedoms of data subjects, as
well as the possibility that a controller could use the legal basis of the contract to process its users'
data for targeted advertising purpose. The FR SA stresses out that such processing would be
particularly massive and intrusive, thus that it is not in line with the provisions of the GDPR.
189. The EDPB considers that the objections raised by the FR SA and the IT SA with regard to the processing
of special categories of personal data have a direct connection with the Draft Decision, as they refer
(1) to the lack of conclusions with regard to the lawful ground applicable to the processing of such
data, and (2) the rejection of the Complainant’s argument of the processing of such data by WhatsApp

267 WhatsApp IE’s Article 65 Submissions, paragraph 4.3.
268 WhatsApp IE’s Article 65 Submissions, paragraphs 4.15 to 4.16.
269 WhatsApp IE’s Article 65 Submissions, paragraph 4.17.
270 WhatsApp IE’s Article 65 Submissions, Annex 1, Section 3.a, paragraph 2.b.

Adopted 45

IE. Both are found to be relevant and, if followed would lead to a different conclusion since the IE SA
would have to carry out further investigations in order to establish whether WhatsApp IE processes
special categories of personal data, and if so, whether this is done in compliance with the conditions
set forth in Article 9 GDPR.
190. The EDPB notes that both objections argue on factual and legal mistakes in the Draft Decision that
would require amendments, thus they are both reasoned. According to the FR SA, the IE SA’s reasoning
is not consistent, as the latter has not considered the matter related to the lawful ground for the
processing of special categories of personal data, nor evaluated its compliance with Article 9(2) GDPR,
thus the IE SA shall carry out the necessary investigations. As for the IT SA’s arguments, the EDPB notes
that no in-depth assessment was conducted by the IE SA regarding the allegations made by the
Complainant that WhatsApp IE processes special categories of personal data, and instead simply
endorsed WhatsApp IE’s argument that all communications are encrypted.
191. In the Draft Decision, the EDPB identifies, as previously asserted by the FR SA and the IT SA, risks for
the fundamental rights and freedoms of the data subjects, with concrete examples of targeted and
behavioural advertising given, that would hinder the users’ ability to have control over their data, thus
the FR SA’s and IT SA’s objections are considered reasoned.
192. Taking into account the objection raised by the FR SA concerning the legal basis for the provision of
metrics to third parties, the EDPB considers that it has a direct connection to the Draft Decision,
because it reflects on the fact that the IE SA does not define what the processing for provision of
metrics to third parties covers, and does not pronounce itself on the legal basis applicable to such
processing (including sharing between companies within the same group), even though initially
mentioned in the latter. The objection is relevant, because if it were followed, different conclusions
would be reached regarding the conditions under which WhatsApp IE collects consent of data subjects
for the processing of their personal data for provision of metrics to third parties.
193. The EDPB notes that the FR SA puts forward arguments regarding factual and legal mistakes that relate
to the legal basis applicable to the provisions of metrics to third parties, and regarding the lack of
definition of what the aforementioned processing entails. For these reasons, the FR SA’s objection is
considered reasoned.
194. As regards the risks posed by the Draft Decision, the EDPB takes note of the FR SA’s remark that the
Draft Decision would be detrimental for the fundamental rights and freedoms of data subjects, as the
only information provided by the IE SA does not amount to any assessment.
195. An objection is raised by the IT SA with regard to the exchange of personal data with affiliated
companies. The EDPB is of the view that it has a direct connection to the Draft Decision, as the latter
only covers two purposes of processing, namely this of service improvement and security, out of those
raised by the Complainant, hence lacks an assessment of the exchange of data between WhatsApp IE
and its affiliated companies. The EDPB considers the IT SA’s objection to be relevant, because, if
followed, it would lead to different conclusions in the Draft Decision, regarding the assessment related
to the core functions of the contract and the exchange of data with affiliated companies.
196. As regards to the risks posed to the fundamental rights and freedoms of data subjects, the EDPB takes
note of the IT SA’s remarks that if the Draft Decision is left unchanged, it would lead to a severe
infringement of the users’ right to self-determine the processing of their sensitive personal data, as
also related to the exchange of data with affiliated companies and, thus, it would prevent the users to
have control over their data.

Adopted 46

197. The EDPB notes that the IT SA’s objection includes clarifications and arguments on factual and legal
mistakes, namely the failure of the IE SA to conduct investigations with regard to the exchange of data
with affiliated companies not only for service improvement purposes, but also for unspecified ones,
related to the management and the overall provision of the service.
198. Finally, the EDPB considers that the objection raised by the FI SA, with regard to the processing of
personal data for the purposes of marketing, has a direct connection with the Draft Decision, as it
reflects on the fact that the IE SA concludes that there is no evidence of processing related to
marketing. The FI SA’s objection is considered relevant, as if followed it would lead to a different
conclusion regarding the legal basis, namely this of Article 6(1)(b) GDPR for processing of personal data
for marketing purposes.
199. The FI SA puts forward arguments regarding the factual and legal mistakes made by the IE SA, relating
to the legal basis for processing of personal data and the possibility for the respective WhatsApp IE
users to receive marketing messages. For these reasons, the FI SA’s objection is considered reasoned.
200. As regards to the risks posed by the Draft Decision to the fundamental rights and freedoms of the data
subjects, the EDPB takes note of the FI SA’s remark that it would incur a risk for data subjects and,
more precisely, their unawareness of the processing and, as a consequence, their subsequent inability
to have control over the processing of their personal data. Moreover, the EDPB considers that this
could lead to undermining their fundamental right of protection of their personal data.

6.1.4.2 Assessment on the merits

201. In accordance with Article 65(1)(a) GDPR, in the context of a dispute resolution procedure, the EDPB
shall take a binding decision concerning all the matters which are the subject of the relevant and
reasoned objections, in particular whether there is an infringement of the GDPR.

202. The EDPB considers that the objections found to be relevant and reasoned in this subsection require
an assessment of whether the Draft Decision needs to be changed, as they conclude that the IE SA has
not carried out a enough investigation as to the applicable legal basis for WhatsApp IE’s processing
operations (a) for the purposes of behavioural advertising, (b) involving special categories of personal
data pursuant to Article 9 GDPR, (c) for provision of metrics to third parties and (d) for the exchange
of data with affiliated companies for the purposes of service improvements and (e) for the purposes
of marketing. When assessing the merits of the objections raised, the EDPB also takes into account
WhatsApp IE’s position on the objections.
203. In its submissions, WhatsApp IE supports the conclusions made by the IE SA that no further
investigation is needed as regards the aforementioned issues raised.
204. With regard to behavioural advertising, WhatsApp IE states that it does not engage in such processing,
which fact was subsequently “appropriately addressed” 271 by the IE SA in its Draft Decision.
205. As for the special categories of personal data 272 , WhatsApp IE contends that it does not process such
data in the course of providing the WhatsApp IE services. Moreover, the processing in question has
already been addressed by the IE SA in its Draft Decision, concluding that there is no evidence that it
is taking place and that it is irrelevant to the complaint and the inquiry.

271
WhatsApp IE’s Article 65 Submissions, Annex 1, Section 1.a, paragraph 6.a, as well as paragraph 4.27 idem.
272
WhatsApp IE’s Article 65 Submissions, Annex 1, Section 1.a, paragraph 6.g.

Adopted 47

206. Moreover, WhatsApp IE argues that it does not rely on Article 6(1)(b) GDPR as a legal basis for
processing for the provision of metrics to third parties 273 . Further, such processing is carried out on a
controller-to-processor basis in order to assist WhatsApp IE in processing that forms part “of the
general improvements”. WhatsApp IE adds that there is no requirement to have a distinct legal basis
for such sharing. It states that “the provision of the WhatsApp Service does not involve any sharing of
EU WhatsApp users’ personal data with other Meta Companies on a controller to controller basis”.
Furthermore, WhatsApp IE opines that the matter of further sharing 274 with “unspecified partners and
service providers” is not relevant to the issues investigated by the IE SA, nor does it have connection
to the substance of the complaint or the Draft Decision.

207. Finally, with regard to the processing for the purposes of direct marketing, WhatsApp IE argues 275 that
it is irrelevant and falls outside of the defined scope of the inquiry.
208. The IE SA argues 276 that it would have been infeasible, hypothetical, and contrary to the complaint
within the meaning of Article 77 GDPR to undertake an assessment of all discrete processing
operations associated generally with the WhatsApp IE’s Terms of Service, including whether WhatsApp
IE processes special categories of personal data in this context and whether the sharing of data with
third parties specifically is lawful, as well as the additional matters concerning WhatsApp IE, in order
to conclude an investigation of the complaint. In relation to the processing of Article 9 GDPR categories
of personal data, the IE SA considers that the inquiry has addressed the fundamental issue of principle
on which the complaint depends, and this makes it unnecessary to conduct an indiscriminate and
open-ended assessment of processing falling within the scope of this Article or the ePrivacy
Directive 277 .
209. Moreover, the IE SA considers that there is no evidence for the assertion that WhatsApp IE is
processing personal data, that facilitates the inferring of special categories of personal data, pertaining
to religious views, sexual orientation, political views and health status. Further, as stated, no evidence
is presented in this regard at all, thus a conclusion is made that the processing of special categories of
personal data, pursuant to Article 9 GDPR consent does not fall within the scope of the complaint and
is thus irrelevant. The Complainant considers the agreement to the Privacy Policy and the Terms of
Service to be an alleged consent to data processing operations designated in those documents. This
also includes the aforementioned data processing operations and the respective purposes, thus the
EDPB considers that those processing operations are within the scope of the complaint.
210. In addition and taking into account the previous paragraph, the IE SA 278 warns the CSAs on the legal
risks derived from asking through the objections to expand the material scope of the inquiry and thus
cover infringements outside of the complaint (namely the processing of special categories of personal
data, question of location data, factual investigations into the presence of behavioural advertising,
sharing with third parties) and the Draft Decision that the IE SA has not investigated (pursuant to its
own decision to limit the scope of the inquiry) and put to WhatsApp IE as an allegation of
wrongdoing 279 .

273
WhatsApp IE’s Article 65 Submissions, paragraphs 4.15 and 4.16.
274
WhatsApp IE’s Article 65 Submissions, paragraph 4.17.
275 WhatsApp IE’s Article 65 Submissions, Annex 1, Section 3.a, paragraph 2.b.
276 Composite Response, paragraph 22.
277 Composite Response, paragraph 27.
278 Composite Response, paragraph 28.
279 Composite Response, paragraphs 29 and 31.

Adopted 48

211. The EDPB notes that the complaint reiterates the confusion of WhatsApp IE’s users over whether it
processes personal data for the purposes of behavioural advertising, which of the users’ special
categories of personal data are processed and for which purposes, the provision of metrics to third
parties and the exchange of data with affiliated companies and on which basis, as well as for the
processing of personal data for the purposes of marketing.

212. WhatsApp IE’s Terms of Service note in general terms “WhatsApp works with partners, service
providers, and affiliated companies to help us provide ways for you to connect with their services. We
use the information we receive from them to help operate, provide, and improve our Services”;
“WhatsApp uses the information it has and also works with partners, service providers, and affiliated
companies to do this” and in the matter of sharing data with affiliated companies: “We are part of the
Facebook Companies. As part of the Facebook Companies, WhatsApp receives information from, and
shares information with, the Facebook Companies as described in WhatsApp's Privacy Policy”.
213. The Terms of Service make up the entire agreement, and include a reference to two separate
documents: WhatsApp IE’s Privacy Policy and to the Meta Companies. WhatsApp IE’s Privacy Policy
states that “The types of information we receive and collect depend on how you use our Services. We
require certain of Your Account Information in accordance with our Terms to deliver our Services and
without this we will not be able to provide our Services to you.” With regard to sharing information
with third parties, the Privacy Policy states that “You share your information as you use and
communicate through our Services, and we share your information to help us operate, provide,
improve, understand, customise and support our Services”. Further, the document itself does not make
any references whatsoever for the processing of data for the purposes of behavioural advertising, or
the processing of special categories of data pursuant to Article 9 GDPR. As for the provision of metrics
to third parties and the exchange of data with affiliated companies, as well as the processing of
personal data for the purposes of marketing, the Privacy Policy does not elaborate further on that
matter.
214. The CJEU asserted recently that the purpose of Article 9(1) GDPR is to ensure an enhanced protection
of data subjects for processing, which, because of a particular sensitivity of the personal data
processed, is liable to constitute a particularly serious interference with the fundamental rights to
respect for private life and to the protection of personal data, guaranteed by Articles 7 and 8 of the
Charter 280 . The CJEU adopts a wide interpretation of the terms “special categories of personal data”
and “sensitive data” that includes data liable indirectly to reveal sensitive information concerning a
natural person 281 . Advocate General Rantos reiterates the importance for the protection of data
subjects of Article 9 GDPR and applies the same interpretation to the potential data processing in the
WhatsApp services for behavioural advertising by stating that “the prohibition on processing sensitive
personal data may include the processing of data carried out by an operator of an online social network
consisting in the collection of a user’s data when he or she visits other websites or apps or enters such
data into them, the linking of such data to the user account on the social network and the use of such
data, provided that the information processed, considered in isolation or aggregated, make it possible
to profile users on the basis of the categories that emerge from the listing in that provision of types of
sensitive personal data.”

280 Vyriausioji tarnybinės etikos komisija (Case C-184/20, judgment delivered on 1 August 2022),
ECLI:EU:C:2022:601, § 126.
281 Vyriausioji tarnybinės etikos komisija (Case C-184/20, judgment delivered on 1 August 2022),

ECLI:EU:C:2022:601, § 127.

Adopted 49

215. Therefore, the GDPR and the case-law pay especial attention to the processing or the potential
processing of special categories of personal data under Article 9 GDPR to ensure the protection of the
data subjects. In this connection, the Complainant alleges in its complaint, among others, a violation
of Article 9 GDPR and expressly requests the IE SA to investigate WhatsApp IE’s processing operations
covered by this provision. In a subsequent submission on the preliminary Draft Decision, the
Complainant criticises the scope that the IE SA decided to give to the complaint and its lack of
investigation of WhatsApp IE’s processing activities and alleges that the IE SA failed to give due
consideration to processing under Article 9 GDPR and other cases in which it relies on consent.
216. In the present case, the IE SA did not carry out any investigation, regarding (a) the legal basis for
WhatsApp IE’s processing operations for the purposes of behavioural advertising, (b) the applicable
legal basis for processing special categories of personal data, pursuant to Article 9 GDPR, (c) the
applicable legal basis for provision of metrics to third parties and (d) the exchange of data with
affiliated companies for the purposes of service improvements and (e) the processing of personal data
for the marketing purposes. The IE SA categorically concludes that no further investigation is needed
with regard to these issues.

217. By failing to investigate, further to the complaint, the processing of special categories of personal data
by WhatsApp IE, the IE SA leaves unaddressed the risks this processing poses for the Complainant and
for WhatsApp IE’s users in general. First, there is the risk that the Complainant’s special categories of
personal data are potentially processed by WhatsApp IE to build intimate profiles of them for the
purposes of behavioural advertising without a legal basis and in a manner not compliant with the GDPR
and in particular the strict requirements of Articles 7 and Article 9(2) GDPR. Second, there is also the
risk that WhatsApp IE does not consider certain categories of personal data it potentially processes, as
special or sensitive categories of personal data in line with the GDPR and the CJEU case-law and treats
them accordingly. Third, the Complainant and other WhatsApp IE’s users, whose sensitive data are
potentially processed may be deprived of certain special safeguards derived from the use of consent,
such as the possibility to specifically consent to certain processing operations and not to others and to
the further processing of personal data under Article 6(4) GDPR; the freedom to withdraw consent,
pursuant to Article 7 GDPR, and the subsequent right to be forgotten. Fourth, given the size and the
number of users of WhatsApp IE in the social media market, leaving unaddressed the current
ambiguity in the processing of special categories of personal data, and its limited transparency of
WhatsApp IE vis-à-vis data subjects, may set a precedent for controllers to operate in the same manner
and create legal uncertainty, hampering the free flow of personal data within the EU.
218. The EDPB further considers, also in view of these risks to the Complainant and WhatsApp IE’s users,
that the IE SA did not handle the complaint with all due diligence. The EDPB considers the lack of any
further investigation into the legal basis for WhatsApp IE’s processing operations for the purposes of
behavioural advertising, the potential processing of special categories of personal data, applicable
legal basis for provision of metrics to third parties and the exchange of data with affiliated companies
for the purposes of service improvements, as well as the processing of personal data for the purposes
of marketing as an omission, and – in the present case – finds it relevant that the Complainant alleged
infringements of Article 9 in the complaint.
219. The EDPB contends that in the present case, the IE SA should have verified on the basis of the contract
and the data processing actually carried out on which legal bases each data processing operation in
question relies.
220. The EDPB also highlights that by having excessively limited the scope of its inquiry despite the scope
of the complaint in this cross-border case and systematically considering the majority of the objections

Adopted 50

raised by the CSAs not relevant and reasoned and thus denying their formal admissibility, the IE SA as
LSA in this case, constrains the capacity of CSAs to act and tackle the risks to data subjects in sincere
and effective cooperation. As ruled by the CJEU, the SA must exercise its competence within a
framework of close cooperation with other supervisory authorities concerned and cannot “eschew
essential dialogue with and sincere and effective cooperation with the other supervisory authorities
concerned”. The limited scope that the IE SA gave to the inquiry also impairs the EDPB’s capacity to
conclude on the matter pursuant to Article 65 GDPR and thus ensure a consistent application of EU
data protection law, despite the fact that the complaint covered these aspects and was introduced
more than four years ago.

221. As a result of the limited scope of the inquiry and lack of assessment by the IE SA in the Draft Decision,
the EDPB does not have sufficient factual evidence on WhatsApp IE’s processing operations to enable
it to make a finding on any possible infringement by WhatsApp IE of its obligations under Article 9
GDPR and other relevant GDPR provisions.
222. The EDPB decides that the IE SA shall carry out an investigation into WhatsApp IE’s processing
operations in its service in order to determine if it processes special categories of personal data (Article
9 GDPR), processes data for the purposes of behavioural advertising, for marketing purposes, as well
as for the provision of metrics to third parties and the exchange of data with affiliated companies for
the purposes of service improvements, and in order to determine if it complies with the relevant
obligations under the GDPR. Based on the results of that investigation and the findings, the IE SA shall
issue a new Draft Decision in accordance with Article 60 (3) GDPR.

7 ON CORRECTIVE MEASURES OTHER THAN ADMINISTRATIVE FINES
7.1 Analysis by the IE SA in the Draft Decision
223. According to the Draft Decision, the IE SA concludes that the Complainant’s case is not made out that
the GDPR does not permit the reliance by WhatsApp IE on Article 6(1)(b) GDPR in the context of its
offering of Terms of Service 282 . Therefore, without finding any infringement of this legal basis, the IE
SA was not in a position to consider the application of its corrective powers as provided for in Article
58(2) GDPR.
224. Regarding the provision of necessary information relating to WhatsApp IE’s legal basis for processing
pursuant to acceptance of the Terms of Service and whether the information set out was in a
transparent manner, the IE SA recalled that it found infringements in this regard in a previous own-
volition inquiry and exercised a number of corrective powers in response, including an administrative
fine and an order to bring the WhatsApp IE’s Privacy Policy into compliance 283 .

7.2 Summary of the objections raised by the CSAs
225. The NO SA objects to the IE SA’s finding by stating that WhatsApp IE cannot rely on Article 6(1)(b)
GDPR as a legal basis for processing in the context of service improvements and security features284 .
As a consequence resulting from the finding of such infringement, the NO SA requests the IE SA to
exercise corrective powers under Article 58(2) GDPR accordingly, by ordering WhatsApp IE to delete

282 Draft Decision, Issue 2.
283
Draft Decision, paragraph 5.9 and last row of the table in p. 38.
284 NO SA Objection, p. 1, Introductory remarks, paragraph 3.

Adopted 51

personal data that has been unlawfully processed under the erroneous assumption that it could be
based on Article 6(1)(b) GDPR unless those data were also collected for other purposes with a valid
legal basis, and by imposing an administrative fine against WhatsApp IE for unlawfully processing
personal data in the context of service improvements and security features, erroneously relying on
Article 6(1)(b) GDPR, as that legal basis was not applicable in this case 285 .
226. The DE SAs object to the IE SA’s finding by stating that the IE SA should find that WhatsApp IE has
breached the Article 5(1)(a) and Article 6(1) GDPR. As a consequence resulting from the finding of such
infringements, the DE SAs request the IE SA to impose a temporary or definitive limitation of the
respective processing without legal basis in accordance with Article 58(2)(f) GDPR, namely, the erasure
of unlawfully processed personal data and the ban of the processing of data until a valid legal basis is
in place 286 .
227. The FI SA objects to the IE SA’s finding by stating that the IE SA should find an infringement of Article
6(1) GDPR, notably because the FI SA is of the opinion that WhatsApp IE cannot rely on Article 6(1)(b)
GDPR for all the processing operations set out in the Terms of Service, such as marketing, service
improvements and security purposes 287 . As a consequence resulting from the finding of such
infringement, the FI SA requests the IE SA to make use of its corrective power accordingly, pursuant to
Article 58(2) GDPR 288 . In order to do so, the FI SA is of the opinion that the IE SA should at least order
WhatsApp IE to bring its processing operations into compliance with the provisions of Article 6(1) GDPR
with respect to the processing of marketing, service improvements and security for which WhatsApp
IE relied upon Article 6(1)(b) GDPR and consider imposing an administrative fine pursuant to Article 83
GDPR 289 .

7.3 Position of the IE SA on the objections
228. The IE SA is of the opinion that since it does not follow the objections raised on the infringements
matters, it results that the IE SA does not follow the related objections on the corrective measures
either 290 . The IE SA also does not consider the objections to be relevant and/or reasoned.

7.4 Analysis of the EDPB

7.4.1 Assessment of whether the objections were relevant and reasoned
229. The objections raised by the NO SA, DE SAs and FI SA concern “whether the action envisaged in the
Draft Decision complies with the GDPR” 291 .
230. As stated and analysed above in Subsection 4.4.1, the EDPB finds the NO SA and DE SA objections on
the subject of corrective measures pursuant to Article 58(2) GDPR relevant but not reasoned 292 .
231. Regarding the FI SA’s objection, WhatsApp IE considers it not relevant because it is based on an
objection pertaining to a mistaken allegation of infringement of Article 6(1) GDPR 293 and which does

285 NO SA Objection, p. 8-9, Envisaged outcome of the RRO, second bullet point.
286 DE SA Objection, p. 8, d. Envisaged result of the objection.
287 FI SA Objection, paragraph 36.
288 FI SA Objection, paragraph 36.
289 FI SA Objection, paragraph 36.
290 WhatsApp IE's Article 65 Submissions, paragraph 80.
291 EDPB Guidelines on RRO, paragraph 32.
292 Paragraphs 75, 80, 86 and 87 above.
293 WhatsApp IE's Article 65 Submissions, table p. 96, section A, paragraph 3.

Adopted 52

not satisfy the thresholds and lacks of merit 294 . The EDPB does not follow WhatsApp IE’s position as it
analyses and concludes in Subsection 4.4.1 above that the objection of the FI SA on the finding of an
infringement of Article 6 GDPR or more specifically Article 6(1)(b) GDPR, on which the FI SA request of
corrective measures is based, is relevant and reasoned.
232. The FI SA’s objection arguing that the IE SA should, in application of Article 58(2) GDPR, at least order
WhatsApp IE to bring its processing operations into compliance with the provisions of Article 6(1) GDPR
with respect to the processing of marketing, service improvements and security for which WhatsApp
IE relied upon Article 6(1)(b) GDPR and consider imposing an administrative fine pursuant to Article 83
GDPR, is linked to the IE SA’s Finding 2 of its Draft Decision with regard to Article 6(1)(b) GDPR.
Therefore, the FI SA objection is directly connected with the substance of the Draft Decision and if
followed, would lead to a different conclusion, namely a change of this Finding 2 as well as the
imposition of corrective measures.
233. Thus, the EDPB considers that the FI SA objection is relevant.
234. In terms of arguments clarifying why the amendment of the Draft Decision requested by the FI SA is
proposed, the FI SA firstly argues that if the IE SA does not make use of its corrective powers, there is
a danger that WhatsApp IE continues to unlawfully process personal data on the foot of Article 6(1)(b)
GDPR for processing operations such as marketing, service improvements and security, and that
WhatsApp IE continues to undermine or bypass data protection principles 295 .
235. Secondly, the FI SA argues that because WhatsApp IE cannot rely on Article 6(1)(b) GDPR for all
processing operations set out in its Terms of Service, this inevitably leads to the conclusion that
corrective powers must be exercised in order to bring the processing operations of WhatsApp IE in line
with the GDPR 296 .
236. Thirdly, the FI SA relies on the ruling of the CJEU C-311/18 Schrems II 297 to argue that when an
infringement is found, the supervisory authority must take appropriate action in order to remedy any
findings of inadequacy and therefore the FI SA is of the opinion that the IE SA must exercise appropriate
and necessary corrective powers 298 .
237. Finally, according to the FI SA, the IE SA must exercise appropriate and necessary corrective powers
and must take into account the nature and severity of the abovementioned infringement since the FI
SA is of the opinion that this infringement cannot be consider as minor 299 .
238. In terms of the significance of the risks posed by the Draft Decision, the FI SA argues that the absence
of appropriate and necessary corrective powers would amount to a dangerous precedent, sending a
deceiving message to the market and to data subjects, and would also endanger the fundamental
rights and freedoms of data subjects whose personal data are and will be processed by the WhatsApp
IE 300 .
239. In addition, the FI SA argues that if WhatsApp IE could continue to rely on Article 6(1)(b) GDPR, the
data subjects would not have the possibility to control the processing of their personal data, while the
right to monitor the processing of personal data is an important principle of the GDPR. 301

294 WhatsApp IE's Article 65 Submissions, table p. 96, section A, paragraph 4.
295 FI SA Objection, paragraph 37.
296 FI SA Objection, paragraph 40.
297 C-311/18 Schrems II, paragraph 111.
298 FI SA Objection, paragraphs 41-42.
299 FI SA Objection, paragraphs 42-43.
300 FI SA Objection, paragraph 45.
301 FI SA Objection, paragraph 45.

Adopted 53

240. The FI SA ends its argumentation by stating that the Draft Decision affects all the data subjects within
the EEA. Therefore, the consequences of not making use of the corrective powers pursuant to Article
58(2) GDPR are vast 302 .
241. WhatsApp IE considers that the FI SA objection cannot satisfy the significance of risk threshold, as it
does not set out how the Draft Decision would pose a direct and significant risk to fundamental rights
and freedoms, because it is based on a misunderstanding of the Draft Decision and the defined scope
of inquiry 303 . WhatsApp IE also considers that contrary to the FI SA statement, the GDPR provides data
subjects with a range of controls and rights over their personal data regardless of the legal bases relied
on and therefore the Draft Decision does not pose a risk to data subjects’ fundamental rights and
freedom 304 . Moreover, WhatsApp IE considers that the FI SA statement that the Draft Decision affects
all the data subjects within the EEA and that therefore, the consequences of not making use of the
corrective powers pursuant to Article 58(2) GDPR are vast, is based on unsubstantiated concerns and
unsupported by any facts or legal reasoning or anything which was investigated in the inquiry 305 .
242. Considering WhatsApp IE’s arguments, the EDPB understands that WhatsApp IE is challenging the
substance of the FI SA objection instead of challenging its ability to clearly demonstrate the significance
of the risks posed by the Draft Decision 306 .Therefore, the EDPB considers these arguments not
applicable to assess whether the FI SA’s objection is reasoned.
243. As the FI SA objection clearly demonstrates why an amendment of the Draft Decision is proposed and
how this amendment would lead to a different conclusion as to whether the envisaged action in
relation to WhatsApp IE complies with the GDPR, it clearly demonstrates a sound and substantiated
reasoning and the significance of the risks posed by the Draft Decision.
244. Therefore, the EDPB considers the FI SA objection to be reasoned.
245. Considering the FI SA objection and the arguments brought forward by WhatsApp IE, the EDPB
considers that the FI SA objection requesting corrective measures to be imposed according to Article
58(2) GDPR is relevant and reasoned pursuant to Article 4(24) GDPR.

7.4.2 Assessment on the merits
Preliminary matters

246. The EDPB considers that the FI SA objection found to be relevant and reasoned in Subsection 7.4.1
requires an assessment of whether the Draft Decision needs to be changed in respect of the corrective
measures proposed. More specifically, the EDPB needs to assess whether the IE SA should impose an
order on WhatsApp IE to bring its processing operations in compliance with the provisions of Article
6(1) GDPR with respect to the processing for marketing, service improvements and security for which
WhatsApp IE relied upon Article 6(1)(b) GDPR and consider imposing an administrative fine pursuant
to Article 83 GDPR, in application of Article 58(2) GDPR.
247. Any issue concerning the imposition of administrative fines is covered below in Section 8.
248. Concerning the issue of imposing corrective measures in respect of the alleged infringement of Article
6(1)(b) GDPR for processing personal data for marketing purpose raised by the FI SA and which was
not part of the scope of the inquiry 307 , it is appropriate to refer to the EDPB conclusion as stated above

302
FI SA Objection, paragraph 46.
303 WhatsApp IE's Article 65 Submissions, table p. 96, section A, paragraph 5.
304 WhatsApp IE's Article 65 Submissions, table p. 96, section A, paragraph 6.
305 WhatsApp IE's Article 65 Submissions, table p. 96, section A, paragraph 7.
306 Guidelines on RRO, paragraph 18.
307 Draft Decision, paragraph 4.8.

Adopted 54

in Subsection 6.1.4.2, which notably states that the IE SA is instructed to launch an investigation into
WhatsApp IE’s processing operations in its service in order to determine if it processes personal data
for marketing purposes and in order to determine if it complies with the relevant obligations under
the GDPR. In this situation where the possibility for WhatsApp IE to rely on Article 6(1)(b) GDPR for
processing personal data for marketing purpose has not been investigated, there is no ground to
further proceed in the assessment of the merits of the FI SA’s objection requesting to impose
corrective measures for processing personal data for marketing purpose by unlawfully relying on
Article 6(1)(b) GDPR.
249. Conversely, concerning the issue of imposing corrective measures in respect of the alleged
infringement of Article 6(1) GDPR for processing for other purposes stated in the FI SA’s objection, it
is appropriate to refer to the EDPB conclusion as stated above in Subsection 4.4.2, which notably states
that WhatsApp IE has infringed Article 6(1) GDPR by unlawfully processing the Complainant’s personal
data, in particular by inappropriately relying on Article 6(1)(b) GDPR to process the Complainant’s
personal data for the purposes of service improvement and security 308 features processing operations
in the context of its Terms of Service. As a consequence, the EDPB further proceed in the assessment
of the merits of these parts of the FI SA objection 309 and analyses whether an order to bring processing
into compliance should be imposed.
250. When assessing the merits of the objection raised, the EDPB also takes into account WhatsApp IE’s
position on the objection and its submissions and the findings in this Binding Decision.
251. It is also important to clarify the EDPB’s views in respect of its competence, in contrast to WhatsApp
IE’s argument, which considers the EDPB is not competent to direct the IE SA to adopt specific
corrective measures 310 .
252. WhatsApp IE states “This is clear from the objection of the Finnish SA, which acknowledges that it is for
the IE SA alone to decide which corrective measures are appropriate and necessary, citing Case C-
311/18 (Schrems II), para 112” 311 .
253. The EDPB finds that WhatsApp IE misunderstands the FI SA objection when it argues that it does
acknowledge that it is for the IE SA alone to decide which corrective measures are appropriate and
necessary, by citing paragraph 112 of the Judgement of the CJEU of 16 July 2020, Data Protection
Commissioner v Facebook Ireland Limited and Maximillian Schrems, C-311/18, ECLI:EU:C:2020:559 ,
(hereinafter ‘C-311/18 Schrems II'). In fact, the FI SA does no such thing: in its objection “The FI SA
refers to the ruling of the CJEU C-311/18 where it was stated that if a supervisory authority takes the
view that an infringement was found, the respective supervisory authority must take appropriate action
in order to remedy any findings of inadequacy” 312 in order to support its conclusion, which states that
because “WhatsApp cannot rely on Article 6(1) (b) for all processing operations set out in its Terms of
Service. This inevitably leads into the conclusion that corrective powers must be exercised in order to
bring the processing operations of WhatsApp in line with the GDPR” 313 . Thus, this statement by the FI
SA seems to simply strengthen the need for appropriate corrective measures to be imposed.
254. Moreover, WhatsApp IE considers the IE SA has sole discretion to determine the appropriate corrective
measures in the event of a finding of infringement 314 .

308 See paragraph 90 of this Binding Decision.
309 FI SA Objection, paragraph 36.
310 WhatsApp IE's Article 65 Submissions, paragraphs 8.6 to 8.11.
311 WhatsApp IE's Article 65 Submissions, paragraph 8.9.
312 FI SA Objection, paragraph 41.
313 FI SA Objection, paragraph 40.
314 WhatsApp IE's Article 65 Submissions, paragraphs 8.12 to 8.14.

Adopted 55

255. WhatsApp IE considers that where a Draft Decision does not find an infringement and therefore
proposes no corrective measures, there cannot be a dispute on corrective measures within the scope
of Article 65 GDPR. WhatsApp IE argues that “should the EDPB find an infringement of Article 6(1)(b)
GDPR, the appropriate course is for it to refer the matter back to the DPC, as IE SA, to determine
whether to impose any appropriate corrective measures and, if so, what those corrective measures
should be. Were the EDPB to do otherwise and direct the DPC to make a specific order in the terms
proposed by certain Objections, it would exceed its competence under Article 65 GDPR” 315 .
256. WhatsApp IE’s states that it is “a matter for the LSA to determine which (if any) corrective measures to
order and to ensure that any order complies with all applicable procedural safeguards, including those
provided for under national law, and is issued in accordance with due process and in circumstances
where the controller has been afforded a right to be heard” 316 .
257. WhatsApp IE also argues that “In the context of an inquiry relating to cross-border processing, the
power to determine which measures are appropriate to exercise under the GDPR is a matter within the
sole competence of the DPC as IE SA — not the EDPB” 317 . While WhatsApp IE acknowledges that “Article
65(1) GDPR allows the EDPB to consider reasoned objections concerning whether corrective measures
envisaged by the IE SA comply with the GDPR”, it argues “it does not empower the EDPB to issue
prescriptive instructions as to which (if any) of the corrective powers under Article 58 ought to be
exercised” 318 . WhatsApp IE adds that “As noted in the EDPB Guidelines 03/2021 on the application of
Article 65(1)(a) GDPR (‘Article 65 Guidelines’), at most, the EDPB can ‘instruct the IE SA to re-assess the
envisaged action and change the draft decision in accordance with the binding decision of the
EDPB’” 319 .
258. According to the EDPB, the views of WhatsApp IE amount to a misunderstanding of the GDPR one-
stop-shop mechanism and of the shared competences of the CSAs. While the EDPB agrees that the IE
SA does act as ‘sole interlocutor’ of the controller or processor 320 , this should not be understood as
meaning it has ‘sole competence’ in a situation where the GDPR requires supervisory authorities to
cooperate pursuant to Article 60 GDPR to achieve a consistent interpretation of the Regulation321 . The
fact that the IE SA will be the authority that can ultimately exercise the corrective powers listed in
Article 58(2) GDPR cannot neither limit the role of the CSAs within the cooperation procedure nor the
one of the EDPB in the consistency procedure 322 .
259. Therefore, contrary to WhatsApp IE’s views, the consistency mechanism may also be used to promote
a consistent application by the supervisory authorities of the corrective measures, taking into account
the range of powers listed in Article 58(2) GDPR, when a relevant and reasoned objection questions
the action(s) envisaged by the Draft Decision towards the controller or processor, or the absence
thereof. More specifically, when raising an objection on the existing or missing corrective measure in
the Draft Decision, the CSA should indicate which action it believes would be appropriate for the IE SA
to undertake and include in the final decision.
260. As mentioned above, aside from the question of administrative fines tackled below in Section 8, the FI
SA calls on the IE SA to use its corrective powers under Article 58(2) GDPR, by imposing an order on

315 WhatsApp IE's Article 65 Submissions, paragraph 8.11.
316 WhatsApp IE's Article 65 Submissions, paragraph 8.13.
317 WhatsApp IE's Article 65 Submissions, paragraph 8.14.
318 WhatsApp IE's Article 65 Submissions, paragraph 8.14.
319 WhatsApp IE's Article 65 Submissions, paragraph 8.14.
320 Article 56(6) GDPR.
321 See Article 51(2), Article 60, Article 61(1) GDPR and the Judgement of the CJEU of 15 June 2021, Facebook

Ireland Ltd and Others v Gegevensbeschermingsautoriteit, Case C-645/19, ECLI:EU:C:2021:483, (hereinafter ‘C-
645/19 Facebook Ireland Ltd and Others’), paragraphs 53, 63, 68, 72.
322 Articles 63 and 65 GDPR.

Adopted 56

WhatsApp IE to bring its processing operations into compliance with the provisions of Article 6(1) GDPR
with respect to the processing of service improvements and security for which WhatsApp IE relied
upon Article 6(1)(b) GDPR.
WhatsApp IE’s position on the objections and its submissions

261. WhatsApp IE considers that “Any corrective measures should be exercised in a manner consistent with
the principles of proportionality” and “should not go beyond what is necessary to achieve the objective
of ensuring compliance with the GDPR”, in particular in accordance with Recital 129 GDPR 323 .
262. In addition, WhatsApp IE argues that “the EDPB cannot direct, nor can the DPC impose, a corrective
order that would be prescriptive in specifying a legal basis on which WhatsApp Ireland must rely” 324 .
263. Moreover, WhatsApp IE states that “WhatsApp Ireland can only be ordered to bring its processing into
compliance by ensuring it has a valid legal basis for processing and must be afforded discretion as to
how it achieves such compliance” 325 .
264. Finally, WhatsApp IE argues that “There is no basis for the imposition of administrative fines” 326 and “it
would be inappropriate, disproportionate, and unnecessary to impose an administrative fine” 327 , as
further developed by WhatsApp IE in Section 8.
EDPB’s assessment on the merits

265. In assessing the appropriate corrective measures to be applied, Article 58(2)(d) GDPR lists the
following corrective measure:
“order the controller or processor to bring processing operations into compliance with the provisions
of this Regulation, where appropriate, in a specified manner and within a specified period”.
266. According to recital 129 GDPR, every corrective measure applied by a supervisory authority under
Article 58(2) GDPR should be “appropriate, necessary and proportionate in view of ensuring compliance
with the Regulation” in light of the circumstances of each individual case. This highlights the need for
the corrective measures and any exercise of powers by supervisory authorities to be tailored to the
specific case. Recital 129 GDPR also provides that each measure should “respect the right of every
person to be heard before any individual measure which would affect him or her adversely is taken”.
The measures chosen should provide consideration to ensuring that they do not create “superfluous
costs” and “excessive inconveniences” for the persons concerned in light of the objective pursued.
267. Recital 148 GDPR shows the duty for supervisory authorities to impose corrective measures that are
proportionate to the seriousness of the infringement.
268. The EDPB recalls that although the supervisory authority must determine which action is appropriate
and necessary and take into consideration all the circumstances of the processing of personal data in
question in that determination, the supervisory authority is nevertheless required to execute its
responsibility for ensuring that the GDPR is fully enforced with all due diligence 328 .

323 WhatsApp IE's Article 65 Submissions, paragraph 8.15.
324
WhatsApp IE's Article 65 Submissions, paragraph 8.33.
325 WhatsApp IE's Article 65 Submissions, paragraph 8.34.
326 C‑311/18 Schrems II, paragraph 112.
327 C‑311/18 Schrems II, paragraph 112.
328 C‑311/18 Schrems II, paragraph 112.

Adopted 57

269. The EDPB agrees with the FI SA that “the infringement cannot be consider as minor” 329 . The EDPB
reiterates that lawfulness of processing is one of the fundamental pillars of the data protection law
and considers that processing of personal data without an appropriate legal basis is a clear and serious
violation of the data subjects’ fundamental right to data protection. In addition, the infringement in
the present case concerns a high number of data subjects 330 and a large amount of personal data.
270. Indeed, the EDPB agrees with the FI SA that “If the IE SA does not make use of their respective corrective
powers, there is danger that WhatsApp continues to unlawfully process personal data on the foot of
Article 6(1)(b) GDPR” for service improvement and security processing operations 331 and “there is a
danger that WhatsApp continues to undermine or bypass” data protection principles 332 . In addition,
failure to adopt any corrective measure in this case “would amount to a dangerous precedent, sending
a deceiving message to the market and to data subjects, and would endanger the fundamental rights
and freedoms of data subjects whose personal data are and will be processed by the controller”. 333
271. As a consequence, the EDPB finds it appropriate for an order to bring processing into compliance to
be imposed in this case (without prejudice to the additional conclusions in respect of the imposition
of administrative fines available below in Section 8).
272. According to the EDPB, the deadline for compliance with the order should be reasonable and
proportionate, in light of the potential for harms to the data subject rights and the resources available
to the controller to achieve compliance 334 .

273. Finally, the EDPB recalls that non-compliance with an order issued by a supervisory authority can be
relevant both in terms of it being subject to administrative fines up to 20.000.000 euros or, in the case
of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year in
line with Article 83(6) GDPR, and in terms of it being an aggravating factor for the imposition of
administrative fines. 335 In addition, the investigative powers of supervisory authorities allow them to
order the provision of all the information necessary for the performance of their tasks including the
verification of compliance with one of their orders 336 .
274. In light of the above, the EDPB instructs the IE SA to include in its final decision an order for WhatsApp
IE to bring its processing of personal data for the purposes of service improvement and security

329
FI SA Objection, paragraph 43.
330
FI SA Objection, paragraph 46: “the draft decision affects all the data subjects within the EEA. Therefore, the
consequences of not making use of the corrective powers pursuant to Article 58(2) GDPR are vast”.
331 FI SA Objection, paragraph 37.
332 FI SA Objection, paragraph 37.
333 FI SA Objection, paragraph 45.

334 The EDPB recalls its Binding Decision 1/2021 adopted on 28 July 2021 where the EDPB was called to resolve a

dispute pursuant to Article 65 GDPR concerning, among others, the appropriateness of the deadline for
compliance suggested in the draft decision at stake. After highlighting the relevance of Recitals 129 as well as
148 GDPR for the imposition of corrective measures, the EDPB took into account the number of data subjects
affected and the importance of the interest of affected data subjects in seeing the relevant provisions of the
GDPR complied with in a short timeframe. While the EDPB also took note of the challenges highlighted by the
controller, it found in that case that a compliance order with a three months’ timeframe could not be considered
disproportionate considering the infringement as well as the type of organization, its size and the means
(including inter alia financial resources but also legal expertise) available to it. Consequently, the EDPB instructed
the LSA to amend the draft decision by reducing the deadline for compliance from six months to three months.
EDPB Binding Decision 1/2021, paragraphs 254-263.
335 Article 83(2)(i) GDPR.
336 Article 58(1) GDPR.

Adopted 58

features in the context of its Terms of Service into compliance with Article 6(1) GDPR in accordance
with the conclusion reached by the EDPB 337 within a specified period of time 338 .

8 ON THE IMPOSITION OF AN ADMINISTRATIVE FINE
8.1 Analysis by the LSA in the Draft Decision
275. The IE SA as LSA does not find any infringement in the Draft Decision, thus no corrective measures and,
in particular, no administrative fine are foreseen. The IE SA points out that in the own-volition inquiry
in relation to WhatsApp IE’s Privacy Policy (deemed as “WhatsApp Transparency Decision” by the IE
SA) corrective measures and among them an administrative fine are included 339 . Moreover, as further
clarified by the IE SA, no further examination or the issuance of further determination is needed, as
the issues raised in the latter are consistent with the present case.

8.2 Summary of the objections raised by the CSAs
276. The FR SA, NO SA, DE SA and IT SA object to the IE SA’s failure to take action with respect to one or
more specific infringements they deem should have been found and ask the IE SA to impose an
administrative fine as a result of these infringements.
277. The FR SA objects to the absence of an administrative fine by the IESA in its Draft Decision. Since a
breach of Article 6 GDPR has been committed in the opinion of the FR SA, which in light of the serious
character of this infringement should result in the imposition of an administrative fine. If further
breaches were to be identified with regard to the processing related to behavioural advertising,
provision of metrics to third parties and with the processing of special categories of personal data, they
should be taken into account by the IE SA when defining the amount of the administrative fine 340 . The
FR SA therefore asks the IE SA to impose an administrative fine.

278. The NO SA and DE SA also argue that the IE SA should take concrete corrective measures against
WhatsApp IE in relation to the additional infringement of Article 6(1) GDPR or Article 6(1)(b) GDPR,
including to impose an administrative fine 341 .
279. The IT SA argues that there should be an administrative fine following the finding of an infringement
of Article 5(1)(a) GDPR 342 , and of Article 5(1)(b) and (c) GDPR 343 . The IT SA argues that WhatsApp IE has
failed to comply with the general principle of fairness under Article 5(1)(a) GDPR, which, in the view of
the IT SA, entails separate requirements from those relating specifically to transparency. Moreover,
the IT SA states that there is an additional infringement of points (b) and (c) of Article 5(1) GDPR on
account of WhatsApp IE’s failure to comply with the purpose limitation and data minimisation
principles. The IT SA asks for a fine to be issued for those additional infringements.

337 As established above in Subsection 4.4.2.
338 See above footnote 334 on paragraph 272.
339 Draft Decision, paragraph 5.9.
340 FR SA Objection, paragraph 53.
341 NO SA Objection, p. 9; DE SA Objection, p. 8.
342 IT SA Objection, p. 10.
343 IT SA Objection, p. 8.

Adopted 59

280. In addition, the EDPB considers the FI SA’s request to consider the imposition of an administrative fine,
as summarised above in Subsection 7.2, not as a separate objection but rather as a possible outcome
of the IE SA’s use of its corrective powers pursuant to Article 58(2) GDPR 344 .

8.3 Position of the LSA on the objections
281. The IE SA notes in its Composite Response that it is satisfied that the scope of the inquiry is appropriate
and no question of an infringement of these provisions arises from the complaint, therefore the IE SA
would not exercise its corrective powers and would not follow the respective objections 345 .

8.4 Analysis of the EDPB

8.4.1 Assessment of whether the objections were relevant and reasoned
The objections raised by the FR SA, NO SA, DE SA and IT SA concern “whether the action envisaged in
the Draft Decision complies with the GDPR” 346 .
282. In addition to the primary argument levelled against all CSA’s objections 347 as well as the arguments
against the objections regarding Article 6(1) GDPR of these CSAs, WhatsApp IE provides additional
arguments on why it considers these not to be relevant and/or reasoned. In a general manner,
WhatsApp IE argues that in any event, there is no basis for a finding that they infringed Article 6(1), 9
and/or 5 GDPR because the actual processing has not been investigated or assessed in the course of
the inquiry by the IE SA 348 . Moreover, WhatsApp IE opines that the imposition of an administrative fine
with respect to new findings of infringements would violate its right to be heard and rights of the
defence 349 . Furthermore, WhatsApp IE points out that the power to impose an administrative fine
under the GDPR lies within the sole competence of the IE SA and that the EDPB does not have the
power to consider objections solely challenging the amount of a fine or the possible instruction to
impose a fine 350 .
283. WhatsApp IE is of the view that the FR SA’s objection cannot be considered relevant because they are
dependent on another objection, which WhatsApp IE deems “an incorrect allegation of infringement
of Article 6(1)(b) GDPR” 351 . WhatsApp IE also does not consider the FR SAs objection to be reasoned
enough with regards to the power to impose administrative fines lying with the LSA and considers that
the FR SAs objection “fails to specify any direct, substantial, or plausible risks that could be prevented
by applying Article 83(3) GDPR” 352 . Regarding the DE SA and NO SA objections to the imposition of an
administrative fine, WhatsApp IE does not provide arguments against the “relevant and reasoned”
threshold apart from the general positions already reflected.

344 FI SA Objection, paragraph 43 to 46.
345 Composite Response, paragraph 78.
346 Guidelines on RRO, paragraph 32.
347 WhatsApp IE’s argues that these are “matters […] outside the Defined Scope of Inquiry and, as such, these

Objections are not relevant and do not meet the requirements of Article 4(24). Accordingly, the EDPB is not
competent to enter into the substantive consideration of the subject matters of these Objections or to purport
to direct the DPC to find additional infringements of the GDPR” (WhatsApp’s Article 65 Submissions, paragraph
7.3). The EDPB does not share this understanding, as explained above. See Section 4.4.1.
348 WhatsApp IE’s Article 65 Submissions, paragraph 7.5.
349 WhatsApp IE’s Article 65 Submissions, paragraph 7.4.
350 WhatsApp's IE’s Article 65 Submissions, paragraph 7.9.
351 WhatsApp IE's Article 65 Submissions, Annex 1, p. 82.
352 WhatsApp IE's Article 65 Submissions, Annex 1, p. 82-83.

Adopted 60

284. It is in the EDPB’s understanding that the FR SA disagrees with a specific part of the IE SA’s Draft
Decision, namely the lack of an administrative fine regarding the breach of Article 6 GDPR. The FR SA
adds that if additional breaches were to be found after any further investigations by the IE SA, they
should be taken into account when assessing the fine and its amount 353 . In consequence, the EDPB
considers the objection to be relevant.
285. The FR SA further argues that the lack of an administrative fine is in contradiction with the seriousness
of the issues at hand, the nature of the processing and the size of the controller 354 . In the view of the
FR SA, not imposing a fine would clearly be detrimental to the rights, freedoms and guarantees of the
data subjects and would also lead to reduce the authorities' coercive power and, consequently, their
ability to ensure effective compliance with the protection of the personal data of European
residents 355 . Therefore, the EDPB considers the objection to be reasoned and to clearly demonstrate
the significance of the risks posed by the Draft Decision.

***

286. The EDPB recalls that the NO and DE SA argue that WhatsApp IE may not rely on Article 6(1)(b) GDPR
for the specified data processing and the IE SA should exercise its corrective powers and impose an
administrative fine 356 . If followed, these objections would lead to a different conclusion as to the
possible imposition of an administrative fine. In consequence, the EDPB considers the objections to be
relevant and to be reflections upon how the IE SA in their view should 'give full effect to the binding
direction(s) as set out in the EDPB’s decision 357 . The EDPB finds that the objection is concrete in the
change proposed. However, it takes note that the NO and DE SA’s assessment of the risks of the draft
decision relate to the IE SAs interpretation of Article 6(1)(b) GDPR and not sufficiently to the lack of an
imposition of an administrative fine. Therefore, the EDPB does not consider this aspect of the NO and
DE SAs objections to meet the requirements of Article 4(24) GDPR and are therefore not sufficiently
reasoned 358 .
287. Taking into account the aforementioned, the EDPB considers that the objection of the FR SA requesting
the imposition of an administrative fine is relevant and reasoned pursuant to Article 4(24) GDPR.

288. With respect to the objection raised by the IT SA concerning the imposition of an administrative fine
for the alleged infringement of the fairness principle enshrined in Article 5(1)(a), the EDPB finds that it
stands in connection with the substance of the Draft Decision, as it concerns the imposition of a
corrective measure for an additional infringement, which would be found as a consequence of
incorporating the finding put forward by the objection. Clearly, the decision on the merits of the
demand to take corrective measures for a proposed additional infringement is affected by the EDPB’s
decision on whether to instruct the IE SA to include an additional infringement.
289. If followed, the IT SA’s objection sets out how it would lead to a different conclusion in terms of
corrective measures imposed 359 . Therefore, the EDPB finds the objections raised by the IT SA to be
relevant.

353 FR SA Objection, paragraph 53.
354 FR SA Objection, paragraph 56.
355 FR SA Objection, paragraph 56-57.
356 NO SA Objection, p. 8-9; DE SA objection, p.8.
357 Guidelines on Article 65(1)(a) GDPR, paragraph 50.
358 See also Section 4.4.1 of this Binding Decision.

359 IT SA Objection, p. 8-10.

Adopted 61

290. WhatsApp IE argues the IT SA’s objection is insufficiently detailed, adding that it is not possible to
identify the legal arguments the IT SA wishes to put forward in respect of the fine 360 .The EDPB finds
that the IT SA adequately argues why they propose amending the Draft Decision and how this leads to
a different conclusion in terms of administrative fine imposed 361 .
291. WhatsApp IE argues the objection of the IT SA fails to demonstrate the risk posed by the Draft Decision
as required and, in doing so, WhatsApp IE dismisses the concerns articulated by the IT SA on the
precedent the draft decision sets 362 .
292. The EDPB finds that the IT SA articulates an adverse effect on the rights and freedoms of data subjects
if the Draft Decision is left unchanged, by referring to a failure to guarantee a high level of protection
in the EU for the rights and interests of the individuals 363 .
293. Therefore, the EDPB considers the IT SA’s objection concerning the imposition of a fine for the alleged
additional infringement of the principle of fairness enshrined in Article 5(1)(a) GDPR to be reasoned.

***

294. The EDPB recalls its analysis of whether the objection raised by the IT SA in respect of the proposed
alleged additional infringements of Article 5(1)(b) GDPR and 5(1)(c) GDPR meets the threshold set by
Article 4(24) GDPR (see Section 5.4.1 above). In light of the conclusion that such objection is not
relevant and reasoned, the EDPB does not need to further examine this linked objection.
295. Furthermore, with regard to the FI SA’s objection the EDPB recalls the analysis made in Subsection
7.4.1 and in 8.2 of this Binding Decision.

8.4.2 Assessment on the merits

296. In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the
matters which are the subject of the relevant and reasoned objections, in particular whether the
envisaged action in relation to the controller or processor complies with the GDPR.
297. Regarding the processing of purposes or of data categories raised by the FR SA and which were not
part of the scope of the inquiry, it is appropriate to refer to the EDPB conclusion as stated above in
subsection 6.1.4.2, where the IE SA is instructed to launch further investigations.
298. Regarding the FI SA’s objection as mentioned in Subsection 8.2 and analysed in Section 7, the EDPB
again recalls that it only takes note of it, as it is not deemed a separate objection but rather a possible
outcome of the IE SA’s use of its corrective powers pursuant to Article 58(2) GDPR.

299. When assessing the merits of all the objections raised, the EDPB also takes into account WhatsApp IE’s
position on the objection and its submissions.
300. WhatsApp IE considers that the LSA has sole discretion to impose an administrative fine. WhatsApp IE
argues that in the context of a matter relating to cross-border processing, the power to impose an

360 WhatsApp IE's Article 65 Submissions, Annex 1, p. 108-109.
361
The IT SA argues that the finding of such infringement “should result into the imposition of the relevant
administrative fine as per Article 83(5)(a) GDPR”, adding the requirement that each fine should be
proportionate and dissuasive and arguing the gravity of the infringement, see IT SA Objection, p. 10.
362 WhatsApp IE's Article 65 Submissions, Annex 1, p. 109.
363 IT SA Objection, p. 10.

Adopted 62

administrative fine under the GDPR lies within the sole competence of the LSA and not the CSAs or the
EDPB. Furthermore, WhatsApp IE argues that the GDPR does not confer any power on the EDPB to
consider objections solely challenging the amount of a fine, and the EDPB may not give instructions as
to whether a fine ought to be imposed, or as to its amount 364 .
301. According to the EDPB, the views of WhatsApp IE amount to a misunderstanding of the GDPR one-
stop-shop mechanism and of the shared competences of the CSAs. The EDPB responds to WhatsApp
IE’s argument that the LSA has sole discretion to determine the appropriate corrective measures in the
event of a finding of infringement above (see Section 7, paragraph 258-259).
302. While the EDPB agrees that the LSA does act as “sole interlocutor” of the controller or processor365 ,
this should not be understood as meaning it has “sole competence” in a situation where the GDPR
requires SAs to cooperate pursuant to Article 60 GDPR to achieve a consistent interpretation of the
Regulation 366 . The fact that the LSA will be the authority that can ultimately exercise the corrective
powers listed in Article 58(2) GDPR cannot limit the role of the CSAs within the cooperation procedure
or the one of the EDPB in the consistency procedure 367 .
303. Therefore, contrary to WhatsApp IE’s views, the consistency mechanism may also be used to promote
a consistent application by the supervisory authorities of the corrective measures, taking into account
the range of powers listed in Article 58(2) GDPR, when a relevant and reasoned objection questions
the action(s) envisaged by the Draft Decision vis-a-vis the controller/processor, or the absence
thereof 368 . More specifically, when raising an objection on the existing or missing corrective measure
– such as an administrative fine – in the Draft Decision, the CSA should indicate which action it believes
would be appropriate for the LSA to undertake and include in the final decision 369 .
8.4.2.1.1 Assessment of whether an administrative fine should be imposed for the infringement of
Article 6(1) GDPR
304. The EDPB considers that the objection found to be relevant and reasoned in this subsection requires
an assessment of whether the Draft Decision needs to be changed in respect to the lack of corrective
measures proposed. More specifically, the EDPB needs to assess the request to impose an
administrative fine for the infringements that are ought to be found by the LSA according to this
Binding Decision. The EDPB recalls its conclusion in this Binding Decision on the infringement of Article
6(1) GDPR 370 .
305. The EDPB concurs that the decision to impose an administrative fine needs to be taken on a case-by-
case basis in light of the circumstances and is not an automatic one 371 . However, the EDPB recalls that

364 WhatsApp IE's Article 65 Submissions, paragraph 7.9.
365 Article 56(6) GDPR.
366 See GDPR Art. 51(2), 60, 61(1), and C-645/19 Facebook Ireland Ltd and Others, paragraphs 53, 63, 68, 72.
367 Article 63 and 65 GDPR.
368 Guidelines on RRO, paragraph 7. Objections may relate to both existing or missing elements in the draft

decision.
369 Guidelines on RRO, paragraphs 29 and 33.
370 See Section 4.4.2 of this Binding Decision.
371 WP29 Guidelines on Administrative fines, p. 6 (“Like all corrective measures in general, administrative fines

should adequately respond to the nature, gravity and consequences of the breach, and supervisory authorities
must assess all the facts of the case in a manner that is consistent and objectively justified. The assessment of
what is effective, proportional and dissuasive in each case will have to also reflect the objective pursued by the
corrective measure chosen, that is either to re-establish compliance with the rules, or to punish unlawful
behavior (or both)”), p. 7 (“The Regulation requires assessment of each case individually”; “Fines are an

Adopted 63

when a violation of the Regulation has been established, competent supervisory authorities are
required to react appropriately to remedy this infringement in accordance with the means provided
to them by Article 58(2) GDPR 372 , which includes the possible imposition of an administrative fine
pursuant to Article 58(2)(i) GDPR 373 .
306. Indeed, as already mentioned the consistency mechanism may also be used to promote a consistent
application of administrative fines 374 : where a relevant and reasoned objection identifies shortcomings
in the reasoning leading to the imposition of the fine at stake (or naturally the lack of one), the EDPB
can instruct the LSA to engage in a new assessment of the need for a fine or the calculation of a
proposed fine 375 .

307. The EDPB again wants to recall that although the supervisory authority must determine which action
is appropriate and necessary and take into consideration all the circumstances of the processing of
personal data in question in that determination, the supervisory authority is nevertheless required to
execute its responsibility for ensuring that the GDPR is fully enforced with all due diligence 376 . Recital
148 shows the duty for supervisory authorities to impose corrective measures that are proportionate
to the seriousness of the infringement 377 .
308. With respect to the imposition of an administrative fine, the EDPB recalls the requirements of Article
83(1) GDPR, as well as that due account must be given to the elements of Article 83(2) GDPR.
309. As already established the EDPB considers the lawfulness of processing to be one of the fundamental
pillars of the data protection law and that processing of personal data without an appropriate legal
basis is a clear and serious violation of the data subjects’ fundamental right to data protection 378 . The
EDPB therefore agrees with the FR SA in considering the identified breach as serious 379 .
Furthermore, the EDPB takes the view that the infringement at issue relates to the processing of
personal data of a significant number of people in a cross-border scope and that the impact on them
has to be considered 380 .
310. The EDPB underlines that the specific circumstances of the case have to be reflected. Such
circumstances not only refer to the specific elements of the infringement, but also those of the
controller or processor who committed the infringement, namely its size and financial position 381 .

important tool that supervisory authorities should use in appropriate circumstances. The supervisory
authorities are encouraged to use a considered and balanced approach in their use of corrective measures, in
order to achieve both an effective and dissuasive as well as a proportionate reaction to the breach. The point is
to not qualify the fines as last resort, nor to shy away from issuing fines, but on the other hand not to use them
in such a way which would devalue their effectiveness as a tool.”).
372 C-311/18 Schrems II, paragraph 111.
373 See also FI SA Objection, paragraph 43.
374 Recital 150 GDPR.
375 Guidelines on RRO, paragraph 34.
376 C-311/18 Schrems II, paragraph 112.
377 Recital 148 GDPR states, for instance: “in a case of a minor infringement or if the fine likely to be imposed

would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine”.
The EDPB confirmed that “the indications provided by this Recital can be relevant for the imposition of corrective
measures in general and for the choice of the combination of corrective measures that is appropriate and
proportionate to the infringement committed”. EDPB Binding Decision 1/2021, paragraph 256.
378 Article 8(2), EU Charter.
379 FR SA Objection, paragraph 56.
380 See Guidelines on calculation of fines, paragraph 54.
381 On turnover see Guidelines on calculation of fines, paragraph 49; also FR SA objection, paragraph 56.

Adopted 64

311. Though the damage is very difficult to express in terms of a monetary value, it remains the case that
data subjects have been faced with data processing that should not have occurred (by relying
inappropriately on Article 6(1)(b) GDPR as a legal basis as established in section 4.4.2). The data
processing in question entails decisions about information that data subjects are exposed to or
excluded from receiving. The EDPB recalls that non-material damage is explicitly regarded as relevant
in recital 75 GDPR and that such damage may result from situations “where data subjects might be
deprived of their rights and freedoms or prevented from exercising control over their personal data”.
Given the nature and gravity of the infringement of Article 6(1) GDPR, a risk of damage caused to data
subjects is, in such circumstances, consubstantial with the finding of the infringement itself.

312. In the light of the nature and gravity of the infringement pursuant to Article 83(2)(a) GDPR as
identified in the paragraphs above, in the view of the EDPB the combination of the mentioned factors
already clearly tip the balance in favour of imposing an administrative fine.
313. For conduct infringing data protection rules, the GDPR does not provide for a minimum fine. Rather,
the GDPR only provides for maximum amounts in Article 83(4)–(6) GDPR, in which several different
types of conduct are grouped together. A fine can ultimately only be calculated by weighing up all the
elements expressly identified in Article 83(2)(a)–(j) GDPR, relevant to the case and any other relevant
elements, even if not explicitly listed in the said provisions (as Article 83(2)(k) GDPR requires to give
due regard to any other applicable factor). Finally, the final amount of the fine resulting from this
assessment must be effective, proportionate and dissuasive in each individual case (Article 83(1)
GDPR). Any fine imposed must sufficiently take into account all of these parameters, whilst at the same
time not exceeding the legal maximum provided for in Article 83(4)–(6) GDPR 382 .
314. In light of the above, the EDPB instructs the IE SA to impose an administrative fine, remaining in line
with the criteria provided for by Article 83(2) GDPR and ensuring it is effective, proportionate and
dissuasive in line with Article 83(1) GDPR, in accordance with the conclusions reached by the EDPB,
namely the identified infringement of Article 6(1) GDPR.
8.4.2.1.2 Assessment of whether an administrative fine should be imposed for the infringement of
the fairness principle under Article 5(1)(a) GDPR

315. The EDPB recalls its conclusion in this Binding Decision on the infringement by WhatsApp IE of the
fairness principle under Article 5(1)(a) GDPR 383 and that the objection raised by the IT SA, which is
found to be relevant and reasoned, requested the IE SA to exercise its power to impose an
administrative fine 384 .
316. The EDPB takes note of WhatsApp IE’s view that the IT SA objection is not relevant and reasoned385
and also notes that WhatsApp IE takes that view that inappropriate, clearly disproportionate, and
unnecessary to impose an administrative fine 386 .

382
See Guidelines on calculation of fines, paragraph 16.
383 Section 5.4.2 of this Binding Decision.
384 Paragraphs 289-293 of this Binding Decision.
385 Paragraph 138 of this Binding Decision.
386 WhatsApp IE's Article 65 Submissions, Annex 1, p. 109.

Adopted 65

317. The EDPB again recalls that the decision to impose an administrative fine needs to be taken on a case-
by-case basis in light of the circumstances and is not an automatic one 387 and the specificities of the
case have to be taken into account.
318. As previously established, the principle of fairness under Article 5(1)(a) GDPR, although intrinsically
linked to the principles of lawfulness and transparency under the same provision, has an independent
meaning 388 .
319. Considering the EDPB’s findings in Section 5.4.2 that WhatsApp IE has not complied with key
requirements of the principle of fairness, the EDPB reiterates its view that WhatsApp IE has infringed
the principle of fairness under Article 5(1)(a) GDPR and agrees with the IT SA that this infringement
should be adequately taken into account by the IE SA in the calculation of the amount of the
administrative fine to be imposed following the conclusion of this inquiry.
320. Therefore, the EDPB instructs the IE SA to take into account the infringement by WhatsApp IE of the
fairness principle enshrined in Article 5(1)(a) GDPR as established above when determining the fine for
the violation of Article 6(1) GDPR as instructed above. If, however, the IE SA considers an additional
fine for the breach of the principle of fairness is an appropriate corrective measure, the EDPB requests
the IE SA to include this in its final decision. In any case, the IE SA must take into account the criteria
provided for by Article 83(2) GDPR and ensuring it is effective, proportionate and dissuasive in line with
Article 83(1) GDPR.

9 BINDING DECISION
321. In light of the above and in accordance with the task of the EDPB under Article 70(1)(t) GDPR to issue
binding decisions pursuant to Article 65 GDPR, the EDPB issues the following binding decision in
accordance with Article 65(1)(a) GDPR.
322. The EDPB addresses this Binding Decision to the LSA in this case (the IE SA) and to all the CSAs, in
accordance with Article 65(2) GDPR.

323. On the objections concerning whether the LSA should have found an infringement for lack of
appropriate legal basis

1. The EDPB decides that the objections of the DE SA, FI SA, FR SA, NL SA and NO SA regarding
WhatsApp reliance on Article 6(1)(b) GDPR, meet the requirements of Article 4(24) GDPR.
2. The EDPB decides that WhatsApp IE has inappropriately relied on Article 6(1)(b) GDPR to
process the Complainant’s personal data for the purpose of service improvement and security in the
context of its Terms of Service and therefore lacks a legal basis to process these data. WhatsApp IE has
consequently infringed Article 6(1) GDPR by unlawfully processing personal data.
3. The EDPB instructs the IE SA to alter its Finding 2 of its Draft Decision, which concludes that
WhatsApp IE may rely on Article 6(1)(b) in the context of its offering of Terms of Service, and to include
an infringement of Article 6(1) GDPR, on the basis of the conclusion reached by the EDPB in this Binding
Decision.

387 See above paragraph 305 of this Binding Decision.
388 See paragraph 147-149 of this Binding Decision.

Adopted 66

324. On the objections concerning the potential additional infringement of the principle of fairness

4. The EDPB decides that the objection of the IT SA regarding the infringement by WhatsApp IE
of the principle of fairness under Article 5(1)(a) GDPR, meets the requirements of Article 4(24) GDPR.
5. The EDPB instructs the IE SA to find in its final decision an additional infringement of the
principle of fairness under Article 5(1)(a) GDPR by WhatsApp IE.
325. On the objection concerning the potential additional infringement of the principles of purpose
limitation and data minimisation
6. On the objection by the IT SA concerning the possible additional infringements of the principles
of purpose limitation and data minimisation under Article 5(1)(b) and (c) GDPR, the EDPB decides this
objection does not meet the requirements of Article 4(24) GDPR.

326. On the objections concerning the potential need for further investigation:
7. The EDPB decides that the objections of the IT SA, FR SA and FI SA regarding the lack of
investigation of WhatsApp’s processing operations in its service of special categories of personal data
(Article 9 GDPR), of data processed for the purposes of behavioural advertising, for marketing
purposes, as well as for the provision of metrics to third parties and the exchange of data with affiliated
companies for the purposes of service improvements, meet the requirements of Article 4(24) GDPR.
8. The EDPB decides that the IE SA shall carry out an investigation into WhatsApp’s processing
operations in its service in order to determine if it processes special categories of personal data (Article
9 GDPR), processes data for the purposes of behavioural advertising, for marketing purposes, as well
as for the provision of metrics to third parties and the exchange of data with affiliated companies for
the purposes of service improvements, and in order to determine if it complies with the relevant
obligations under the GDPR. Based on the results of that investigation and the findings the IE SA shall
issue a new Draft Decision in accordance with Article 60 (3) GDPR.

327. On corrective measures other than administrative fines
9. The EDPB decides that the objection of the FI SA requesting corrective measures to be imposed
in compliance with the Article 58(2) GDPR meet the requirements of Article 4(24) GDPR.

10.On the objections by the DE and NO SAs requesting corrective measures to be imposed in
compliance with the Article 58(2) GDPR, the EDPB decides that these objections do not meet the
requirements of Article 4(24) GDPR.

11.The EDPB instructs the IE SA to include in its final decision an order for WhatsApp IE to bring
its processing of personal data for the purposes of service improvement and security features in the
context of its Terms of Service into compliance with Article 6(1) GDPR in accordance with the
conclusion reached by the EDPB 389 within a specified period of time 390 .
328. On the objections concerning the imposition of an administrative fine for the lack of legal basis
12.The EDPB decides that the objections of the FR SA regarding the imposition of an
administrative fine for the infringement of Article 6(1) GDPR meets the requirements of Article 4(24)
GDPR.

389 As established above in Subsection 4.4.2.
390
See above footnote 334 on paragraph 272.

Adopted 67

13.The EDPB decides that the relevant parts of the objections of the NO and DE SAs specifically
relating to an administrative fine for the lack of legal basis do not meet the threshold of Article 4(24)
GDPR.
14.The EDPB instructs the IE SA to cover the additional infringement of Article 6(1) GDPR with an
administrative fine, which is effective, proportionate and dissuasive in accordance with Article 83(1)
GDPR. In determining the fine amount, the IE SA must give due regard to all the applicable factors
listed in Article 83(2) GDPR, in particular the nature and gravity of the infringement and the number of
data subjects affected.

329. On the objection concerning the imposition of an administrative fine for the infringement of the fairness
principle under Article 5(1)(a) GDPR
15.The EDPB decides that the objection of the IT SA regarding the imposition of an administrative
fine for the infringement of Article 5(1)(a) GDPR meets the requirements of Article 4(24) GDPR.
16.The EDPB instructs the IE SA to take into account the infringement by WhatsApp IE of the
fairness principle enshrined in Article 5(1)(a) GDPR when determining the fine for the violation of
Article 6(1) GDPR as instructed above. If, however, the IE SA considers an additional fine for the breach
of the principle of fairness is an appropriate corrective measure, the EDPB requests the IE SA to include
this in its final decision. In any case, the IE SA must take into account the criteria provided for by Article
83(2) GDPR and ensuring it is effective, proportionate and dissuasive in line with Article 83(1) GDPR.

330. On the objection concerning the imposition of an administrative fine for the infringement of Article
5(1)(b) and (c) GDPR

17.The EDPB decides that it does not need to examine the objection of the IT SA regarding the
imposition of an administrative fine for the infringement of Article 5(1)(b) and (c) GDPR.

10 FINAL REMARKS
331. This Binding Decision is addressed to the IE SA and the CSAs. The IE SA shall adopt its final decision on
the basis of this binding decision pursuant to Article 65(6) GDPR.

332. Regarding the objections deemed not to meet the requirements stipulated by Art 4(24) GDPR, the
EDPB does not take any position on the merit of any substantial issues raised by these objections. The
EDPB reiterates that its current decision is without any prejudice to any assessments the EDPB may be
called upon to make in other cases, including with the same parties, taking into account the contents
of the relevant draft decision and the objections raised by the CSAs.

333. According to Article 65(6) GDPR, the IE SA shall adopt its final decision on the basis of the Binding
Decision without undue delay and at the latest by one month after the EDPB has notified its Binding
Decision.
334. The IE SA shall inform the EDPB of the date when its final decision is notified to the controller or the
processor 391 . This Binding Decision will be made public pursuant to Article 65(5) GDPR without delay
after the IE SA has notified its final decision to the controller 392 .

391
Article 65(6) GDPR.
392
Article 65(5) and (6) GDPR.

Adopted 68

335. The IE SA will communicate its final decision to the Board 393 . Pursuant to Article 70(1)(y) GDPR, the IE
SA’s final decision communicated to the EDPB will be included in the register of decisions which have
been subject to the consistency mechanism.

For the European Data Protection Board
The Chair

(Andrea Jelinek)

393
Article 60(7) GDPR.

Adopted 69