Article 29 Working Party steps up action over user consent and privacy following Facebook’s failure to address breaches of EU law.

The European Union’s data regulator group is again focusing its attention on WhatsApp for the messaging app’s sharing of user data with parent company Facebook, launching a taskforce to implement “a clear, comprehensive resolution” to comply with EU law.

The taskforce has been set up by the pan-European data regulator, the Article 29 Working Party (WP29), a year after it first issued a warning to the chat app over its sharing of user data with the wider group of Facebook companies, forcing it to pause data transfer. The taskforce will be lead by the UK’s information commissioner office.

Facebook was fined £94m in May for providing misleading information about its 2014 takeover of WhatsApp. It had said it could not match user accounts across both platforms, but then did precisely that.

WhatsApp, used by more than one billion people daily, changed its privacy policy last year to start sharing users’ phone numbers and other information with Facebook. The change drew widespread regulatory scrutiny across Europe including the UK, focused on the requirement for users to consent to the sharing of data and the level of information provided for them to make an informed choice.

In a letter sent to WhatsApp on 24 October, WP29 said the company had still not resolved its concerns about getting user consent for the data sharing.

The regulators picked apart WhatsApp’s legal basis for consent, noting that the information given to users about the privacy policy update was “seriously deficient as a means to inform their consent”. The group said the “take it or leave it approach”, which mandated users who disagreed should simply stop using the service did not constitute freely given consent, while pre-ticked boxes did not constitute unambiguous consent.

“Whilst the WP29 notes there is a balance to be struck between presenting the user with too much information and not enough, the initial screen made no mention at all of the key information users needed to make an informed choice, namely that clicking the agree button would result in their personal data being shared with the Facebook family of companies,” the letter said.

WhatsApp’s additional “notice to EU users”, published in August this year, does not “sufficiently address the issues of non-compliance with data-protection law,” according to WP29, which considers the issue to be of “utmost importance”. The group said that Facebook’s pause in data sharing “for the purpose of improving Facebook products and enhancing targeted advertising” must remain in place until the issue of “unambiguous, specific, informed and feely given” consent is resolved.

A WhatsApp spokesman said: “Over the last year we have engaged with data protection authorities to explain how our 2016 terms and privacy policy update apply to people who use WhatsApp in Europe. We remain committed to respecting applicable law and will continue to work collaboratively with officials in Europe to address their questions.”

Elizabeth Denham, the UK’s Information Commissioner, said: “The efforts of WhatsApp and Facebook to resolve the issues have not yet addressed our concerns. We remain committed to leading a European-level response to these concerns, which affect millions of users in the UK and across the EU.”

WhatsApp’s EU headquarters are in Dublin. The Irish data watchdog said in April that it hoped to reach a deal in the coming months on the data sharing with WhatsApp.

The WP29 action comes ahead of new, more powerful European laws called the General Data Protection Regulation, which will give regulators the power to fine companies up to 4% of global turnover.