The query began after WhatsApp added to its terms of service previous year that it shares data with Facebook for security measures, and to gather business intelligence.
"While the security goal seems to be essential to the efficient functioning of the application, it is not the case for the "business intelligence" objective which aims at improving performances and optimising the use of the application through the analysis of its users' behaviour", noted Chair of the CNIL. According to the public notice published on the French website, WhatsApp now has a month to comply with this order.
What worsened the situation was that WhatsApp declined to provide data transfer samples after repeated requests from the CNIL. The French regulator in its statement on Monday said the formal notice wasn't a sanction, but WhatsApp would risk fines at a later stage if it failed to comply. That, however, appears to be in violation of the French Data Protection Act.
The agency also criticized WhatsApp for "insufficient" cooperation after the initial warning from the European Union privacy authorities that had said they had serious concerns over WhatsApp sharing user data when its users had only signed up to use WhatsApp, not Facebook. "In particular, neither the users' consent nor the legitimate interest of WHATSAPP can be used as arguments in this case". While on the other hand, it has been told to stop sharing its user data with its parent company, Facebook. When installing the application, users must accept that their data are processed for the messaging service, but also, in general, by Facebook for accessory purposes such as the improvement of its service.
It added that "no further action will be taken if the company complies with the Act within the specified timescale".
"WHATSAPP cannot rely on its legitimate interest in massively transferring data to FACEBOOK Inc. insofar as this transmission is not accompanied by sufficient guarantees to preserve the interest or rights and fundamental freedoms of the users since there is no mechanism allowing them to oppose it while continuing to use the application".