Facebook must obtain the permission of German users of WhatsApp before processing their personal data, a German court confirmed on Tuesday.

Last August, Facebook subsidiary WhatsApp changed its privacy policy to allow the transfer of its users’ personal information to Facebook for processing. That angered the Hamburg Commissioner for Data Protection and Freedom of Information, which in September ordered the companies to stop the transfer until they had obtained users’ consent, and to delete any data they had already transferred.

Facebook challenged the order in Hamburg’s administrative court, and on Tuesday the court handed down its ruling.

The court upheld the Commissioner’s requirement to obtain consent, but threw out the order to delete the data on procedural grounds.