Facebook must obtain the permission of German users of WhatsApp before processing their personal data, a German court confirmed on Tuesday.
Last August, Facebook subsidiary WhatsApp changed its privacy policy to allow the transfer of its users’ personal information to Facebook for processing. That angered the Hamburg Commissioner for Data Protection and Freedom of Information, which in September ordered the companies to stop the transfer until they had obtained users’ consent, and to delete any data they had already transferred.
Facebook challenged the order in Hamburg’s administrative court, and on Tuesday the court handed down its ruling.
The court upheld the Commissioner’s requirement to obtain consent, but threw out the order to delete the data on procedural grounds.
Facebook plans to appeal the court’s ruling. “WhatsApp designed its privacy policy and terms update to comply with applicable law,” said a Facebook spokeswoman.
But even that appeal won’t settle the matter, as it only concerns an interim order made by the Commissioner to halt Facebook’s actions until it can examine them in more detail. Facebook is engaging with the regulator to address its questions, the spokeswoman said.
The case promises to be a tricky one: The court said that it was not clear whether German data protection law applied to WhatsApp — but that if it did, WhatsApp’s consent declarations would prove insufficient to comply.
The Commissioner is seeking to protect the interests of about 35 million WhatsApp users in Germany, it said.
