Facebook Inc. and its messaging service WhatsApp each were fined 300,000 euros ($369,471) by Spain’s data protection authority for violating privacy rules by processing user data without consent. The Spanish Data Protection Agency (AEPD) March 15 announced the decision on its website to fine each company the maximum possible for the violations. The decision comes amid a series of European probes into how the companies have handled user data since Facebook acquired WhatsApp in 2014.
The Spanish agency said WhatsApp failed to meet Spanish and European privacy standards when it transferred user data to Facebook without obtaining user consent. Facebook subsequently violated privacy law by using this data for its own means without user permission, the agency said.
Spain’s action comes during heightened European scrutiny into how Facebook and WhatsApp handle user data. Facebook had told European regulators it would not transfer user data before buying the messaging-service company. In 2016, WhatsApp then changed its terms of service to begin sharing user data with Facebook.
A German court March 1 ruled that Facebook could not store WhatsApp data. Whatsapp March 14 pledged to the U.K. privacy regulator that it would not share data with Facebook, and France recently issued a formal order to WhatsApp, seeking to force it to stop sharing data with Facebook without user consent.
Facebook was fined 110 million euros ($136 million) by the European Commission in 2017 for misleading the EU’s regulator during the 2014 review of the WhatsApp takeover.
The Spanish privacy authority said the companies violated article 11 of the Organic Law on the Protection of Personal Data (LOPD) by not obtaining “free, specific and informed” user consent before sharing data.
WhatsApp users that wanted continued access to the messaging service in 2016 had to accept the change of terms without being given adequate information or the clear option to refuse them, the Spanish agency said. New users to the messenger service were never given the option to withhold their data from being shared with Facebook, the agency said.
