EDPB’s first urgent binding decision: threshold not met, Irish DPC to prioritise its investigation
02 August 2021
The Hamburg Commissioner requested the EDPB on 7 June 2021 to issue an urgent binding decision to require the adoption of binding final measures across the EU. The EDPB stated in its Decision that there was insufficient evidence to demonstrate an infringement requiring urgent intervention, particularly given that the issues in consideration existed in previous versions of the terms and conditions. The Hamburg Commissioner also did not demonstrate that the Irish DPC failed to provide information in the context of a formal request for mutual assistance under Article 61 GDPR.
Further, the EDPB noted its concerns about several matters raised by the Hamburg Commissioner, including combination of data by Facebook, WhatsApp and the Facebook Companies, the intended use of WhatApp business API and the lack of clarity and transparency in WhatsApp’s user-facing information. The EDPB concluded that many of these aspects are currently subject to the one-stop-shop procedure led by the Irish DPC, and this procedure is in its final stages.
The EDPB acknowledged that a number of issues require prompt investigation by the Irish DPC and appropriate action. The EDPB asked the Irish DPC to look, as a matter of priority, into several matters.
The Hamburg Commissioner responded to the Decision by stating that it was “disappointing”, questioning whether the response of the Irish DPC and the EDPB was sufficient given the gravity of the issues it had sought to address with its provisional ban.