WhatsApp said that privacy is very important to it and that “it’s why we collect very little data, and encrypt every message.” “We will continue to work with the CNIL to ensure users understand what information we collect, as well as how it’s used,” WhatsApp said in an emailed statement. “We’re committed to resolving the different, and at times conflicting concerns we’ve heard from European data protection authorities with a common EU approach before” new bloc-wide data protection rules enter into force in May 2018. The merging of WhatsApp’s data with Facebook was a first step by Facebook last year toward monetizing the platform since the social network’s Chief Executive Officer Mark Zuckerberg bought the company for about $22 billion in 2014. The EU’s 28 privacy chiefs were critical from the start and as part of their probes across the bloc, in a letter to WhatsApp co-founder Jan Koum in October that stressed their concerns.
The data transfers from WhatsApp to Facebook happen in part without the users’ consent, nor the legitimate interest of WhatsApp, CNIL said. The authority rejected arguments by WhatsApp that it is subject only to the law of the U.S., saying that it becomes the authority in charge the moment any company is processing data in France. The French regulator in its statement on Monday said the formal notice wasn’t a sanction, but WhatsApp would risk fines at a later stage if it failed to comply.