Hamburg's Commissioner for Data Protection and Freedom of Information Johannes Caspar on Tuesday issued an administrative order prohibiting Facebook from collecting and storing the data of German WhatsApp users, saying the company must also delete any data that the messaging service had already handed over.  

"It has to be (the users') decision whether they want to connect their account with Facebook," Caspar said, adding that Facebook had to ask for "permission in advance." The commissioner also noted that the social media giant had originally promised not to collect subscriber data from its subsidiary when it bought WhatsApp in 2014.

Breach of German law

WhatsApp announced in August that it would begin sharing data with Facebook, in a bid to allow better targeted advertising and to fight spam on the platform. Currently, users of the instant messenger must opt out of sending information to Facebook through WhatsApp's settings on their smartphone.

Caspar said that sharing of data between the two companies was an infringement of German data protection law. That's because Facebook had not obtained effective approval from Germany's 35 million WhatsApp users. The watchdog added that millions of people whose contact details had been uploaded to WhatsApp could now have that information shared with Facebook against their will.

Facebook's activities in German-speaking regions are managed through its subsidiary in Hamburg, placing the firm under the jurisdiction of the regulator in the northern port city. The commissioner's decision affects only WhatsApp users in Germany.

In a response, Facebook said it was ready to cooperate with the German authorities. "Facebook complies with EU data protection law. We are open to working with the Hamburg DPA in an effort to address their questions and resolve any concerns," a spokeswoman for the company told the news agency AFP.

WhatsApp's announcement that it would share information with Facebook came just four months after the service introduced end-to-end encryption by default, saying that the content of messages would become unreadable for anyone except the sender and receiver.

Europe has resisted American technology giants' use of people's digital information, routinely forcing companies like Google and Facebook to change their policies after they breached the European Union's tough data protection rules.

uhe/sri (AFP, Hamburg Data Protection Agency)