The UK’s data protection watchdog has concluded that WhatsApp’s sharing of user data with its parent company Facebook would have been illegal.

The messaging app was forced to pause sharing of personal data with Facebook in November 2016, after the Information Commissioner’s Office said it had cause for concern. The ICO opened a full investigation into the matter in August that year.

Elizabeth Denham, the information commissioner, said her investigation foundthat “WhatsApp has not identified a lawful basis of processing for any such sharing of personal data” and that “if they had shared the data, they would have been in contravention of the first and second data protection principles of the Data Protection Act.”

The ICO said WhatsApp had failed to provide adequate information to users explaining the processing and sharing of their data, and that sharing it with Facebook would require processing that is “incompatible with the purpose for which such data was obtained”.

In response WhatsApp has signed an undertaking declaring that it will not share any EU user data with Facebook until the General Data Protection Regulation (GDPR) comes into force on 25 May. It also stated that it would only share data in accordance with the requirements of GDPR after 25 May.

Denham is also chair of the taskforce set up to investigate data sharing between WhatsApp and Facebook by the Article 29 Working Party pan-European data protection group. Article 29 first issued a warning in October 2016 before launching the taskforce a year later.

Various other European countries have also raised concerns over the data sharing, including France which ordered WhatsApp to stop sharing data in December. The EU fined Facebook £94m for providing misleading information over its technical capabilities in terms of sharing user data before its acquisition of WhatsApp in 2014.