France orders WhatsApp to seek permission for data transfer

“Should WhatsApp fail to comply with the formal notice within the specified timescale” the National Data Protection Commission (CNIL) said it may take actions that could lead to a sanction against the company.

It added that “no further action will be taken if the company complies with the Act within the specified timescale.”

After its purchase in 2014 WhatsApp issued new terms of service notifying users that it would transfer their data to its new parent company Facebook.

CNIL said that it considers the transfer of some data for security purposes to be legal, but that the sharing of non-essential information to improve the function of the app was not as users were not given the possibility to opt out.

It mentioned in particular the transfer of data about users such as their phone number and how they use the app as needing specific permission from users.

CNIL said “WhatsApp cannot claim a legitimate interest to massively transfer data to the company Facebook Inc. insofar as this transfer does not provide adequate guarantees allowing to preserve the interest or the fundamental freedoms of users since there is no mechanism whereby they can refuse it while continuing to use the application.”

France’s CNIL has regularly clashed with internet giants such as Facebook and Google over protection of user data.

It noted in its statement on Monday that the European Commission in May fined Facebook 110 million euros ($120 million) for providing incorrect and misleading information on its takeover of WhatsApp.