Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 22 SEPTEMBER 2021

Data Protection: Key Findings From The ECPB's WhatsApp Ireland Decision

Maples Group
Maples Group
Contributor
Maples Group

Maples Group

The Maples Group, through its leading international law firm, Maples and Calder, advises global...

View firm profile
Explore more from Maples Group

On 2 September 2021, the European Data Protection Board ("EDPB") published its decision on the dispute on the draft decision of the Irish Data Protection Commission.

IrelandPrivacy
Claire Morrissey
Claire Morrissey
Author LinkedIn connections

On 2 September 2021, the European Data Protection Board ("EDPB") published its decision on the dispute on the draft decision of the Irish Data Protection Commission ("DPC") regarding WhatsApp Ireland ("WhatsApp") under Article 65(1)(a) of the General Data Protection Regulation ("GDPR"). WhatsApp was issued a ?225 million fine, the largest ever fine from the DPC, and the second-highest under GDPR rules. In this update, we provide an overview of the key findings arising from the EDPB's decision relating to:

  • The strict approach to transparency information when legitimate interests are the legal basis for processing;
  • What amounts to anonymisation versus pseudonymisation for GDPR purposes; and

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

The Data Act – “Access By Design” Requirement Comes Into Force

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act – Part I: Key Considerations Regarding Data Access And Sharing

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act: “Access By Design” Requirement Comes Into Force For Medical Devices

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.
IrelandPrivacy
Matheson
Matheson
Article

New PRC Offshore Trust Tax Rules – Key Implications For Cayman And BVI Offshore Trust Structures

On 24 July 2026, China's Ministry of Finance and State Taxation Administration jointly issued the Announcement on Individual Income Tax Matters Relating to Offshore Trusts (《财政部 税务总局关于离岸信托个人所 得税有关事项的公告》) (Announcement No. 21 of 2026) (the "Notice"), together with a companion Announcement of the State Taxation Administration on Collection and Administration Matters Relating to Individual Income Tax on Offshore Trusts...
GlobalCorporate/Commercial Law
Maples Group
Maples Group
Article

AIFMD II: Key Implementation Developments In Luxembourg

Two years on from the entry into force of Directive (EU) 2024/927, commonly referred to as AIFMD II, the 16 April 2026 transposition deadline has passed, and the state of play across the EU is best described as uneven, with compliance posture increasingly dependent on where an AIFM is authorised. However, Luxembourg, which hosts the largest shares of EU AIFs within the Union, transposed the Directive without material gold-plating.
European UnionFinance and Banking
Maples Group
Maples Group