11

In that regard, it is apparent that, in the contested decision, the EDPB successively took a position solely on the following aspects, which, in its view, had been the subject of relevant and reasoned objections: – whether WhatsApp had failed to comply with the obligations to provide information laid down in Article 13(1)(d) of Regulation 2016/679, relating to certain information to be provided to data subjects where personal data have been collected from them. Such a failure to comply had not been established by the Irish supervisory authority in its draft decision. The EDPB took the view, on the contrary, that WhatsApp had failed to comply with that provision; – the classification as personal data of the material resulting from the ‘lossy hashing procedure’, applied to the data concerning the ‘contacts’ who are non-users of WhatsApp contained in the address books on the devices of WhatsApp users. The Irish supervisory authority had not classified that material as such in its draft decision. The EDPB considered, on the contrary, that it still constitutes personal data. According to the contested decision, that aspect had a potential impact on the possible finding of an infringement by WhatsApp of Article 5(1)(c) and Article 6(1) of Regulation 2016/679 and an impact on the extent of WhatsApp’s infringement of Article 14 of Regulation 2016/679, as well as on the level of the fine incurred on those grounds; – whether WhatsApp infringed the principle of transparency laid down in Article 5(1)(a) of Regulation 2016/679, which the Irish supervisory authority had not established in its draft decision. The EDPB took the view, on the contrary, that that principle had been infringed by WhatsApp; – the finding of an infringement by WhatsApp of Article 13(2)(e) of Regulation 2016/679, relating to certain information to be provided to data subjects where personal data have been collected from them, which the Irish supervisory authority had not considered itself able to make, since the investigator had not taken a position on the issue during the investigation, and in respect of which it had considered itself able only to issue a recommendation. The EDPB considered, on the contrary, that the investigation covered all the provisions of Article 13 of Regulation 2016/679 and that an infringement of that provision had to be established; – whether WhatsApp had infringed Article 6(1) of Regulation 2016/679, concerning the conditions for lawful processing of personal data, on which the Irish supervisory authority had not ruled. The EDPB took the view that, for procedural reasons, it was not possible to rule on the matter or to find that there had been such an infringement; – the extension of the grounds for WhatsApp’s failure to comply with the obligations to provide information laid down in Article 14 of Regulation 2016/679, on the information to be provided where personal data have not been obtained from the data subject, as a result of the analysis relating to the second indent above. The EDPB confirmed the impact that such extension would have on the behavioural corrective measures and the fine imposed on WhatsApp; – whether WhatsApp infringed the principle, laid down in Article 5(1)(c) of Regulation 2016/679, of collecting only data that are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, on which the Irish supervisory authority did not rule. The EDPB took the view that such an infringement had not been demonstrated on the basis of the file, in particular in view of the scope of the investigation with regard to WhatsApp; – the period, set at six months by the Irish supervisory authority, within which, by way of corrective measures, WhatsApp was required to bring its processing into compliance with those requirements of Regulation 2016/679 with which it had failed to comply. The EDPB reduced that period to three months; – as regards corrective measures, the methods of providing information to non-users of WhatsApp regarding the processing of their personal data by WhatsApp. The EDPB confirmed the assessment made by the Irish supervisory authority in that regard in its draft decision; – as regards corrective measures, the statement of the additional grounds for WhatsApp’s failure to comply with the obligations laid down in Article 14 of Regulation 2016/679 (see the second indent above). The EDPB stated that that statement was necessary to ensure that WhatsApp adopts appropriate corrective actions in that regard; – the criteria for the quantum of the fines to be imposed on WhatsApp, in the light of Article 83 of Regulation 2016/679, relating to the ‘general conditions for imposing administrative fines’. The EDPB took the view that the Irish supervisory authority had misinterpreted the criterion relating to the worldwide annual turnover of the undertaking concerned; that it had correctly interpreted the concept of ‘preceding financial year’; that it had misinterpreted the rule that, if several provisions of Regulation 2016/679 are infringed in the context of the same or linked processing operations, the total amount of the administrative fine cannot exceed the amount specified for the gravest infringement; and that it had correctly interpreted certain criteria set out in Article 83(1) and (2) of Regulation 2016/679 for determining the fine (intentional or negligent character of the infringements, gravity of the infringements), but had misinterpreted other of those criteria (taking into account turnover in order to quantify the penalty independently of the calculation of its upper limit and, more generally, the need for the penalty to be effective, proportionate and dissuasive); – the level of the fines. The EDPB considered that, in the light of the Irish supervisory authority’s misinterpretation of certain criteria relating to the quantum of the fine (see the eleventh indent above) and the necessary finding of additional failures by WhatsApp to comply with its obligations (see the first, third, fourth and sixth indents above), the amounts of the fines envisaged by the Irish supervisory authority at a total level of between EUR 30 and EUR 50 million had to be increased.