On July 16, 2024, the Federal Public Prosecutor’s Office (“MPF”) filed a public civil action against WhatsApp LLC Inc. (“WhatsApp”) and the Brazilian National Data Protection Authority (“ANPD” or “Brazilian DPA”), requesting compensation of approximately 1.7 billion reais from WhatsApp due to violations of the Brazilian General Data Protection Law (“LGPD”), Internet Civil Framework, and Consumer Protection Code in WhatsApp’s privacy policy.
The case is based on the changes in WhatsApp’s privacy policy in 2021, initially analysed jointly by MPF and ANPD, along with the Administrative Council for Economic Defense (“CADE”) and the National Consumer Secretariat (“SENACON”). This analysis, coordinated by the ANPD, was concluded with a Technical Note in which the Brazilian DPA stated that its requests had been met by WhatsApp and closed the case.
In the public civil action, the MPF argues that WhatsApp failed to comply with its transparency and information obligations, used invalid legal bases for data processing, and carried out inappropriate data sharing practices among Meta Group companies and abusive consumer practices, causing extensive damage to the data subjects.
Regarding the ANPD, the MPF argues that the Brazilian DPA failed to observe its legal duties of accountability, efficiency, and transparency, for allegedly conducting the administrative procedure assessing WhatsApp’s Privacy Policy changes with total secrecy from the public and opacity from other bodies, including the MPF itself.
The case in question demonstrates the importance of establishing a privacy policy in compliance with the LGPD, using adequate legal bases and purposes for the data processing by the controllers, ensuring the necessary transparency and information to the data subjects.
Our team is at your disposal for further clarifications and to assist with complying with LGPD and ANPD regulatory requirements.
Gustavo Flausino Coelho – gustavo@bastilhocoelho.com.br
Fernando Naegele – fernando@bastilhocoelho.com.br