Elizabeth Denham, Information Commissioner, said WhatsApp has failed to identify "a lawful basis of processing for any such sharing of personal data" and sharing it would have involved processing the information for a goal other to that for which it was intended.
My investigation has not been concerned about WhatsApp's sharing of personal data with Facebook when Facebook are only providing a support service to WhatsApp.
Ms Denham added she was pleased WhatsApp had signed the agreement to cease sharing until it can do so in compliance with the forthcoming General Data Protection Regulation (GDPR), due to come into force in May.
WhatsApp's public commitment to keep private its users' information also puts an end to an ICO investigation into potential data sharing between the messaging app and Facebook, which purchased WhatsApp for $19 billion in 2014.
The problem is that this data continues to be shared outside of the United Kingdom and the European Union and now there's no way to opt-out of it for users elsewhere. They state that data protection should be both by design and default in any operation. At that point, WhatsApp and Facebook will be able to share data "for safety and security purposes" or to improve products and advertising, as long as the process of sharing that data complies with GDPR standards.
The ICO announced today that it has completed its investigation into whether WhatsApp was legally entitled to share user data with Facebook in the manner the firm was considering. I reached the conclusion that an undertaking was the most effective regulatory tool for me to use, given the circumstances of the case. "This is common practice and if done consistently with the law, under contract, does not generally raise data protection concerns", she wrote, noting that data protection law does not prevent a company from sharing personal data, it just means they have to follow the legal requirements. WhatsApp has agreed to an undertaking of that effect, which can be read here.
The UK's Information Commissioner's Office summarised their investigation here.