Monday 23 September 2019

DPC probes Verizon as WhatsApp result looms

Yahoo owner now under scrutiny

Scrutiny: Data protection commissioner Helen Dixon
Scrutiny: Data protection commissioner Helen Dixon
Adrian Weckler

Adrian Weckler

The Irish data protection commissioner has opened an investigation into Verizon Media, formerly called Oath, which owns online properties such as Yahoo and the 'Huffington Post'.

The investigation comes on foot of complaints across the EU related to the company's use of online cookies.

Please log in or register with Independent.ie for free access to this article.

Log In

Helen Dixon's office is overseeing the investigation as the company's EU headquarters are based in Dublin.

"It's specifically into transparency issues," Ms Dixon told Independent.ie. "There were more than 38 complaints redirected to us by other EU data protection authorities.

"Those authorities were in receipt of a significant volume of complaints from individuals, specifically relating to services by media sites."

She said that some of the complaints related to when "effectively there's no choice when cookie banners are offered. The only option seems to be to click OK".

Other online properties owned by Verizon Media include Engadget and AOL. It is currently in the process of selling the social media platform Tumblr to Automattic, which owns Wordpress.

Ms Dixon also said that her office's first major GDPR decision relating to a multinational tech firm looks set to be about WhatsApp. "I expect that file to land on my desk in the next fortnight," she said.

However, it is then likely to take "months" to arrive at a formal decision, due to a statutory process of "examination and analysis".

She added: "I'd like to say that we could do it in 48 hours, but it has to be in the order of months, to be done in the way that it has to be done. I will have to allow them a period of time to respond. I would have to consider their responses."

Under GDPR law, the Irish DPC can fine a company up to 4pc of its annual turnover.

Earlier this summer, US authorities fined Facebook $5bn (€4.5bn) for data privacy failings in the largest settlement of its kind to date.

However, Ms Dixon said that while the Irish office was prepared to use the "scope" of the GDPR's maximum 4pc fine structure, the EU process is different to the American one.

"We're not really looking at $5bn or what the FTC has done," she said. "We've got to look at this fairly under the legal framework that we have.

"One criticism of the FTC's decision is that it has done nothing to change Facebook's business model, or the way that Facebook will handle personal data. The decisions that we make here have to have an impact, in terms of how the GDPR must be applied."

The Irish DPC office currently has 61 statutory enquiries under way, under GDPR law, 21 of which are focused on tech multinational firms.

These include Facebook (eight), Twitter (three), Apple (three), WhatsApp (two), Instagram (one), Google (one), LinkedIn (one), Quantcast (one) and Verizon Media (one).

Irish Independent

Also in Business