The National Data Protection Commission (CNIL) said on Monday that it had given WhatsApp a month to comply with the order. It emphasised that particular attention should be given to getting consent from users, Reuters reported.
The watchdog said that WhatsApp had no legal grounds for sharing user data with Facebook; under French law, it was obligated to comply with CNIL.
While the WP29 had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook, the company had said it could not do so as it was located in the US and considered that it was subject only to US law.
CNIL said it had decided to make the matter public "in order to ensure the highest level of transparency on the massive data transfer from WhatsApp to Facebook and... (highlight) the need for individuals concerned to keep their data under control".
"Should WhatsApp fail to comply with the formal notice within the specified timescale, the Chair may appoint an internal investigator, who may draw up a report proposing that the CNIL’s restricted committee responsible for examining breaches of the Data Protection Act issue a sanction against the company," the CNIL warned.