In an enforcement action that perhaps underscores the rapidly changing nature of privacy and the importance of nomenclature, the European Commission announced today it has fined Facebook 110 million euros “for providing incorrect or misleading information during the Commission's 2014 investigation under the EU Merger Regulation of Facebook's acquisition of WhatsApp.” 

At the time of the acquisition, the Commission asked Facebook whether it would be able “establish reliable automated matching between Facebook users’ accounts and WhatsApp users’ accounts.” Facebook stated it would not be able to do this. Then, when WhatsApp announced new terms of service for WhatsApp in August 2016, it mentioned the possibility of linking WhatsApp user phone numbers with Facebook profiles.

The Commission took notice. “The Commission has found that, contrary to Facebook's statements in the 2014 merger review process,” a press release reads, “the technical possibility of automatically matching Facebook and WhatsApp users' identities already existed in 2014, and that Facebook staff were aware of such a possibility.”

The EU Merger Regulation requires companies to provide accurate information when describing mergers and acquisitions, regardless of whether the information would have impacted the decision to let that acquisition or merger go forward. In this case, the Commission notes that the information would not have affected the decision to let the deal take place. Further, the Commission said, “today's decision is unrelated to either ongoing national antitrust procedures or privacy, data protection or consumer protection issues, which may arise following the August 2016 update of WhatsApp terms of service and privacy policy.”

Facebook, in a statement provided to The Privacy Advisor, attributed the inaccurate information to “errors” that were “not intentional.”

“We’ve acted in good faith since our very first interactions with the Commission,” a Facebook spokesman said, “and we’ve sought to provide accurate information at every turn.”

What, actually, is “automated matching”? Facebook apparently interpreted the matter relatively narrowly, thinking operationally. The Commission apparently interpreted the matter broadly, pure technical feasibility.

"Facebook acknowledged its infringement of the rules and waived its procedural rights to have access to the file and to an oral hearing. This allowed the Commission to conduct the investigation more efficiently. The Commission has taken Facebook's cooperation into account in setting the level of the fine." -European Commission statement

Once Facebook understood the nature of its infringement, it essentially took its medicine. In assessing the €110 million fine, which is less than the ceiling of 1 percent of global turnover, “The Commission has also considered the existence of mitigating circumstances, notably the fact that Facebook cooperated with the Commission during the procedural infringement proceedings. In particular, in its reply to the Commission's Statement of Objections, Facebook acknowledged its infringement of the rules and waived its procedural rights to have access to the file and to an oral hearing. This allowed the Commission to conduct the investigation more efficiently. The Commission has taken Facebook's cooperation into account in setting the level of the fine.”

The Commission called the fine “both proportionate and deterrent.”

It may also be notable that this is the first fine levied by the Commission under the 2004 Merger Regulation, which granted the Commission much higher fining powers.

“Today’s decision,” said Commissioner Margrethe Vestager, who oversees competition policy, “sends a clear signal to companies that they must comply with all aspects of EU merger rules, including the obligation to provide correct information.”