Perhaps coincidental or a mark of intent on the week of the second anniversary of the GDPR, the Irish Data Protection Commission (DPC) released some significant updates on their investigations in to the data protection practices of a number of the “big tech” social media companies. The DPC has been subject to much scrutiny coming in to May 2020 over its failure to issue any fines or to conclude any of the multiple GDPR investigations it is conducting on the “big tech” firms. The recent fines to Tusla and the below developments on progress towards decisions relating to the social media companies may be a sign of things to come. DPC decisions, and possibly fines, may be just around the corner.
Twitter – Draft Decision
The DPC has completed a self-initiated inquiry led investigation into Twitter International Company and its’ data protection practices, following a data breach notification raised to the DPC by the company. A draft decision has been issued by the DPC and focuses on Twitter’s data controller obligations per GDPR Article 33(1) (notification to the DPC) and 33(5) (documentation relating to the data breach).
WhatsApp – Preliminary Draft Decision
A draft decision has also been issued by the DPC to WhatsApp Ireland Limited for review. This relates to the investigations in to WhatsApp’s adherence with GDPR Articles 12 and 14 regarding the transparency and provision of information to users about the personal data shared with Facebook.
Facebook complaint – At Decision-Making Stage
The DPC has completed an investigation phase for a complaint-based inquiry against Facebook. A decision now needs to be made by the DPC.
Instagram & WhatsApp complaints – Draft Inquiry Reports Issued
Two more complaint investigations, one relating to Instagram and the other to WhatsApp, are progressing as the DPC issued draft inquiry reports to both the complainants and the companies involved.
Schrems update – Judgment date confirmed & DPC legal fees released
The judgment on the long-running saga that is the case of Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Case C-311/18) has been confirmed for 16 July. The judgment is widely expected to bring much needed clarity on lawful international transfers of personal data.
The impact of the case was not only confined to the legal aspects, as this week also saw the release of the DPC’s legal fee information and the disclosure that the case has cost the DPC €2.9m over the past four years – an eye watering 63% of the total €4.6m legal fees paid by DPC during the four year period.
The DPC has 23 live investigations against the “big tech” companies. Symmetry Compliance’s blog will be providing updates on these investigations and on the DPC decisions as they progress.