On 18 July 2024 the Federal Competition and Consumer Protection Commission (FCCPC) of Nigeria has imposed a $220 million fine on Meta Platforms Inc. and WhatsApp LLC. The FCCPC and the Nigeria Data Protection Commission (NDPC) conducted a joint investigation into WhatsApp regarding potential violations of Nigerian consumer rights in data privacy, which began in May 2021 following the introduction of WhatsApp’s updated privacy policy.
Meta was included in the investigation “because it is WhatsApp’s parent company, and exercises control over the business practices of WhatsApp. Additionally, evidence showed that Meta stands to benefit from particular updates in the Policy through various technical integrations”.
Breaches Found
- Unfair Privacy Policy: WhatsApp’s updated privacy policy, effective 15 May 2021, was found to be unfair and coercive. Users were forced to accept terms that allowed excessive data collection and sharing without proper consent.
- Dominance Abuse: WhatsApp abused its dominant position by imposing a privacy policy that users could not opt-out from, thus coercing acceptance through service limitations.
- Data Sharing Without Consent: The policy allowed the sharing of user data with Facebook and third parties without explicit consent, violating Nigerian Data Protection Regulation (NDPR) requirements.
- Discrimination: Nigerian users were treated less favorably compared to European users, who had more robust privacy protections under the EU GDPR.
- Excessive Data Collection: WhatsApp collected more data than necessary for its services, sharing this data with Facebook, which was deemed exploitative and unnecessary.
Sanctions
- Financial Penalties: Meta and WhatsApp were fined $220 million, payable within 60 days from the order date, and an additional $35,000 to cover investigation costs.
- Policy Changes: Meta and WhatsApp must immediately update its privacy policy to comply with Nigerian laws, ensuring clear and intelligible consent processes.
- Data Practices: WhatsApp must stop sharing user data with Facebook and third parties until users provide explicit, informed consent.
- User Rights: WhatsApp must reinstate Nigerian users’ rights to control their data usage, processing, sharing, or transfer, and provide the option to restrict or withdraw consent without losing app functionality.
- Rollback to 2016 Practices: WhatsApp must revert to its 2016 data-sharing practices and establish an opt-in mechanism for additional data sharing, subject to FCCPC and NDPC approval.
The press release, final order, investigative report, and executive summary are all available here.
♻️ Share this if you found it useful.
💥 Follow me on Linkedin for updates and discussions on privacy, digital and AI education.
📍 Subscribe to my newsletter for weekly updates and insights – subscribers get an integrated view of the week and more information than on the blog.
