The Irish arm of WhatsApp has set aside €77.5 million (U.S. $91.8 million) for possible administrative fines arising from long-standing investigations by Ireland’s data regulator into the way the messaging platform shares data with Facebook, which owns it.
The provision has contributed to the firm making an €11.2 million (U.S. $13.3 million) loss for the year ending Dec. 31, 2019, according to the latest set of accounts the company filed at the end of October with Ireland’s Companies Registration Office.
In a note to the accounts, WhatsApp said the “provisions relate to amounts identified for administrative fines arising from regulatory compliance matters presently under investigation by the Irish Data Protection Commission (IDPC).”
WhatsApp adds it expects these regulatory matters to be “settled anytime within the next two financial years,” though concedes it could take longer.
In a statement to Compliance Week, a spokesperson said: “As stated in the filing, the provisions noted represent our estimate of possible future fines resulting from ongoing investigations by the IDPC,” adding that “it is not accurate to assume that [this provision] relates to a single inquiry.”
The firm also said, “There are many stages to complete before these inquiries conclude which means that the estimates that we’ve provisioned for in these accounts are subject to change.” It does not rule out appealing or disputing any penalty imposed.
WhatsApp believes the costs of any fine, as well as any compliance-related costs, could be between €35 million and €105 million (U.S. $41.5 million to $124.4 million) “based on the advice from outside legal counsel, regulatory correspondence received in 2019 and 2020, and relevant mitigating and other factors, which under the relevant legislation may impact any final fine amounts.”
The reference to “relevant legislation” includes the General Data Protection Regulation (GDPR).
The IDPC’s investigation into WhatsApp concerns whether the company has failed to comply with Articles 12 to 14 of the GDPR in relation to transparency around what information is shared with Facebook.
The Commission submitted its preliminary decision to WhatsApp Ireland earlier this year. It is not yet known when a final decision will be announced.
However, WhatsApp’s latest filings might fuel speculation the firm has cut a deal with the regulator following British Airways’ prescient disclosure in its half-yearly results in August that it had made a provision of €22 million (U.S. $26 million) for its GDPR penalty with the U.K.’s Information Commissioner’s Office, rather than the £183.4 million fine the regulator had initially proposed. When the penalty was finalized in October, BA’s fine had been reduced to $26 million.
The IDPC was approached for comment but did not respond.
No comments yet