The battle between Facebook's WhatsApp and privacy authortities continues to wage. The latest skirmish sees a consumer rights group (VZBV) in Germany suing Facebook for illegal data collection.
In November last year the ICO demanded that Facebook stop collecting user data in the UK after an 8 week investigation, and numerous other EU countries have ongoing probes. Then, on Dec 20, the EU Commission sent a Statement of Objections alleging Facebook provided misleading information about their WhatsApp takeover.
So here's the deal. When Facebook embarked on its acquisition of WhatsApp in 2014, the EU Commission conducted its standard merger investigation. One of the Commission's concerns was whether Facebook would be able to match its users' accounts with WhatsApp users' accounts. Facebook stated that it would not be possible to make the connection, and the Commission subsequently approved the merger.
Then in August 2016 WhatsApp changed its Terms of Service. It began sharing users' phone numbers and some device analytics with Facebook. The reason given was to help to target advertisements and make better friend recommendations.
But WhatsApp also has access to the phone numbers of the users CONTACTS. Those numbers too are sent to Facebook, even when the contacts are not themsleves WhatsApp users. It is possible for users to opt out of having Facebook use the data to target ads and recommend friend links. But it is NOT possible to prevent the data from being handed over to Facebook.
The German consumer rights group which filed the suit said "WhatsApp collects all the contacts that are saved in your smartphone and uploads them to its servers. This means that your friends who decide - often on purpose - not to use Facebook, cannot prevent Facebook from getting hold of their personal data."
This is not WhatsApp's first skirmish with German courts. Back in May, Germany announced it had issued a judgement against WhatsApp for not having Terms & Conditions in German. T&Cs are already extremely difficult to read, and having them in English left them largely incomprehensible to most Germans, stated the German court.
In addition to the personal privacy violations, the EU is also accusing Facebook of deliberately deceiving the Commission during the merger investigation. At that time Facebook claimed there was no way to cross link their user accounts with WhatApp users. Now the Commission believes Facebook was fully aware they could do the matching.
If the Commission finds Facebook to be in violation, it can fine Facebook 1% of its worldwide revenue. That could amount to over $200 million.