Ban on further processing of user data Hamburg data protection supervisory authority takes action against Facebook and WhatsApp cooperation

von Nadja-Maria

The Hamburg Commissioner for Data Protection and Freedom of Information Johannes Caspar (Hamburg data protection supervisory authority) has issued an order against Facebook to process data from WhatsApp for its own purposes and ordered immediate enforceability for this.


WhatsApp is currently in the process of obtaining consent from all users for new terms of use and privacy. Among other things, these include far-reaching options for WhatsApp to pass on user data to Facebook. Facebook, in turn, would have permission to use this data for its own purposes under these terms.

View of the data protection supervisory authority

In the opinion of the Hamburg Commissioner for Data Protection and Freedom of Information, however, the data processing lacked a suitable legal basis under the General Data Protection Regulation. In particular, the consent obtained from users by WhatsApp cannot constitute effective consent under data protection law, as it is neither voluntary nor transparent. Furthermore, the terms of use are misleading and non-transparent.

In this regard, Johannes Caspar continued: “The order is intended to safeguard the rights and freedoms of the many millions of users who give their consent to the terms of use throughout Germany. The aim is to prevent disadvantages and damages associated with such a black box procedure (…).” (

European approach sought

Due to the requirements of the General Data Protection Regulation, the order issued is only valid for three months. In order to prevent an illegal exchange of data between WhatsApp and Facebook in the longer term, the Hamburg Commissioner for Data Protection and Freedom of Information says that he will request a referral to the European Data Protection Committee in order to achieve a European solution.

Would you like professional support on the subject of data protection or an external data protection officer to accompany you in the long term? You can reach us at our headquarters in Hutthurm near Passau at +49 (0) 8505 91927 – 0 and at our branch office in Munich at +49 (0) 89 413 2943 – 0 or use our contact form.


Nadja-Maria leitet unser Inhouse-Juristen-Team. Sie studierte an der Universität Passau Rechtswissenschaften mit anschließendem Referendariat sowie erstem und zweitem Staatsexamen. Ihr Spezialgebiet ist Datenschutzrecht. Ihr fundiertes Wissen hält sie jederzeit aktuell. Für unsere Kunden und unser Team hat sie so immer einen Rat für eine passgenaue Lösung parat.