Facebook has been ordered to stop collecting and storing data on WhatsApp users in Germany, marking the first regulatory challenge to a controversial data-sharing scheme that the social media company announced in August. In a statement published Tuesday, Germany's privacy watchdog said that sharing WhatsApp user data with Facebook, the messaging app's parent company, constitutes "an infringement of national data protection law." The regulatory body also ordered Facebook to delete all data that has already been transferred from WhatsApp.
Facebook's data-sharing scheme has been closely monitored by privacy groups across Europe. When Facebook acquired WhatsApp in 2014, the app's co-founder, Jan Koum, assured users that their privacy would not be compromised. Under the policy announced in August, however, WhatsApp will share some user data — including phone numbers — with Facebook, and plans to allow businesses to contact users directly through its app.
"Facebook has to ask for their permission in advance. This has not happened."
WhatsApp has said that the arrangement will allow Facebook to deliver more targeted advertising and friend suggestions, and that analytics data will help combat spam and fraud. But privacy advocates have criticized the companies for not being transparent about the change. In a blog post published after the announcement, the Electronic Frontier Foundation (EFF) described the move as "a clear threat to users’ control of how their WhatsApp data is shared and used."
Johannes Caspar, the Hamburg data protection commissioner, echoed those concerns in a statement on Tuesday, saying that Facebook has not "obtained effective approval" of the policy change from WhatsApp users. Caspar also expressed concern that Facebook may eventually seek to collect data on a broader range of users, including those listed in WhatsApp contacts lists who are not connected to Facebook.
"This administrative order protects the data of about 35 million WhatsApp users in Germany," Caspar said. "It has to be their decision, whether they want to connect their account with Facebook. Therefore, Facebook has to ask for their permission in advance. This has not happened."
Other privacy regulators have raised concerns over the data-sharing scheme. CNIL, France's data protection authority and the chair of a group of privacy regulators across Europe, said in August that privacy watchdogs will be monitoring the change to WhatsApp's policy "with great vigilance." The Information Commission's Office (ICO), Britain's data privacy regulator, also said it would monitor how data is shared across the two platforms, though it does not have the authority to block the scheme altogether.
In an email statement, a Facebook spokesperson said that the company will appeal the order from Germany's privacy watchdog.
"Facebook complies with EU data protection law," the spokesperson said. "We will appeal this order and we will work with the Hamburg DPA in an effort to address their questions and resolve any concerns."
Update September 27th, 10:39AM ET: Updated with new statement from Facebook, clarifying the company's plans to appeal.