Facebook has been ordered to stop collecting and storing data on WhatsApp users in Germany, marking the first regulatory challenge to a controversial data-sharing scheme that the social media company announced in August. In a statement published last week, Germany's privacy watchdog said that sharing WhatsApp user data with Facebook, the messaging app's parent company, constitutes "an infringement of national data protection law." The regulatory body also ordered Facebook to delete all data that has already been transferred from WhatsApp. Facebook's data-sharing scheme has been closely monitored by privacy groups across Europe.
When Facebook acquired WhatsApp in 2014, the app's co-founder, Jan Koum, assured users that their privacy would not be compromised. Under the policy announced in August, however, WhatsApp will share some user data — including phone numbers — with Facebook, and plans to allow businesses to contact users directly through its app. WhatsApp has said that the arrangement will allow Facebook to deliver more targeted advertising and friend suggestions, and that analytics data will help combat spam and fraud. But privacy advocates have criticized the companies for not being transparent about the change. In a blog post published after the announcement, the Electronic Frontier Foundation (EFF) described the move as "a clear threat to users’ control of how their WhatsApp data is shared and used."
The German privacy watchdog noted that Facebook had not "obtained effective approval" of the policy change from WhatsApp users. They also expressed concern that Facebook may eventually seek to collect data on a broader range of users, including those listed in WhatsApp contacts lists but who are not connected to Facebook. The administrative order protects the data of about 35 million WhatsApp users in Germany.
Other privacy regulators have raised concerns over the datasharing scheme. CNIL, France's data protection authority and the chair of a group of privacy regulators across Europe, said in August that privacy watchdogs will be monitoring the change to WhatsApp's policy "with great vigilance." The Information Commission's Office (ICO), Britain's data privacy regulator, also said it would monitor how data is shared across the two platforms, though it does not have the authority to block the scheme altogether. In an email statement, a Facebook spokesperson said "Facebook complies with EU data protection law. We will appeal this order and we will work with the Hamburg DPA in an effort to address their questions and resolve any concerns."