WhatsApp has been handed a €225 million fine by Ireland’s Data Protection Commission (DPC) this week, with the messaging platform deemed to be in violation of EU data privacy law.

The DPC was specifically looking into how effectively WhatsApp communicates the handling of data with its users, as well as sharing said information with its parent company Facebook. On both fronts, the platform was seen as non-compliant in terms of EU regulation.

“Following a lengthy and comprehensive investigation, the DPC submitted a draft decision to all Concerned Supervisory Authorities (CSAs) under Article 60 GDPR in December 2020. The DPC subsequently received objections from eight CSAs. The DPC was unable to reach consensus with the CSAs on the subject-matter of the objections and triggered the dispute resolution process (Article 65 GDPR) on 3 June 2021,” a summary of the decision explained.

“On 28 July 2021, the European Data Protection Board (EDPB) adopted a binding decision and this decision was notified to the DPC. This decision contained a clear instruction that required the DPC to reassess and increase its proposed fine on the basis of a number of factors contained in the EDPB’s decision and following this reassessment the DPC has imposed a fine of €225 million on WhatsApp,” it added.

In order to comply with GDPR, WhatsApp has been instructed to update its privacy policy and specifically make changes to how it notifies users regarding data sharing.

The platform plans to appeal the decision, but no word on when this will happen has been confirmed at this stage.

“WhatsApp is committed to providing a secure and private service. We have worked to ensure the information we provide is transparent and comprehensive and will continue to do so. We disagree with the decision today regarding the transparency we provided to people in 2018 and the penalties are entirely disproportionate,” a spokesperson told The Verge.

You can download (PDF) and read the decision in full, here.