Deletion of WhatsApp Correspondence During On-Site Inspections
Introduction
The right to make on-site inspections is one of the Competition Board’s (“Board”) most important tools for revealing whether Law No. 4054 on the Protection of Competition (“Law No. 4054”) has been violated. The effective use of this authority is quite important in terms of obtaining fruitful results from their investigations. Especially with the publication of the Guidelines on the Examination of Digital Data in On-Site Inspections (“On-Site Inspection Guidelines”), the situations that hinder and complicate the on-site inspection as a result of the deletion of WhatsApp correspondence on mobile devices have increased and the number of decisions where the Board has imposed administrative fines have also significantly risen. The Board’s approach towards deleting WhatsApp correspondence during on-site inspections continues to be shaped by its decisions. Specifically, the A101 decision[1] discussed in this article is noteworthy as it demonstrates the current approach of the Board on the subject, as well as the dissenting opinion of some Board members.
The Board’s Approach Set Forth in the A101 Decision
During an investigation[2] carried out by the Board into some undertakings operating as producers, suppliers and retailers in the FMCG sector, an on-site inspection was carried out at Yeni Mağazacılık A.Ş. (“A101”) on 08.12.2021. The computers and mobile devices of various employees present at the company’s premises were subject to examination. The most interesting part of the A101 decision is that the Board evaluated the actions taken by three different employees during the on-site inspection to determine if they constituted a “hindering or complication” for the on-site inspection.
Firstly, as part of the inspection, the business phone of the A101 purchasing general manager was indexed and examined through forensic devices and it was determined that the WhatsApp application was not present on the phone. Subsequently, the employee’s personal phone was examined through the quick review method in order to determine whether it contained digital data belonging to the undertaking. Meanwhile, questions regarding personal information directed to the user during the installation of the WhatsApp application were displayed on the screen. These questions were answered by the employee and the experts could review the application.
When the WhatsApp application was examined, the experts saw that there was no correspondence in the groups where the relevant employee was a participant. Subsequently, the App Store was examined and the experts saw that the WhatsApp application was not among the applications updated and also, the chat backup feature in the WhatsApp application was turned off. In addition, when the mobile device was examined through forensic software, the experts could not detect any log records[3] related to the usage, deletion or reinstallation of the WhatsApp application.
While the computer of another A101 employee was being examined by the experts, they noticed that although it had previously been handed over to the experts as part of the investigation, the employee had turned on his phone. Therefore, the employee’s mobile device was subject to inspection in case he had interfered with the device. The device was examined through forensic software and no log records related to the use of the WhatsApp application were detected.
The product manager, who was not present at the company’s premises during the on-site inspection, was called to the undertaking for the inspection of his computer and mobile device. The employee stated that his personal phone was broken and therefore, he had left the device at home. Accordingly, the experts could not examine his personal phone. When the experts asked for the mobile device he had with him, the employee stated that he had previously deleted the WhatsApp application as it included personal information and chats. However, due to the inability to index on the phone, the experts could not determine whether the WhatsApp application was deleted, or, if there had been a deletion, whether the deletion was made before the on-site inspection started or during the on-site inspection.
On the other hand, as a result of the quick review, the application was not found installed on the mobile device. Thereupon, the WhatsApp application was reinstalled on the mobile device and the correspondence existing within the scope of the last backup were examined with the quick review method in order to determine whether they contained digital data belonging to the undertaking. As a result, the experts found that there was business-related correspondence on the device. Accordingly, the mobile device was subjected to examination through the forensic device. In addition, the broken personal device was taken from the employee’s home and delivered to the experts of the Competition Authority.
As part of its assessment related to the hindering or complication of the on-site inspection, the Board stated that although it was unclear whether any employees engaged in activities aimed at destroying data from their mobile devices during the inspection, no log records were found indicating that the WhatsApp application was deleted as a result of the indexing performed on the phones of two employees with forensic computing devices. The Board also stated that no log record related to the deletion process could be obtained due to the fact that the index of the other employee’s phone could not be obtained. Accordingly, the Board stated that it was not possible to determine through forensic computing devices whether the employees have deleted or reinstalled the WhatsApp application.
The Board emphasized that, in accordance with its established case law, an administrative fine for preventing of an on-site inspection could only be imposed if the deletion had taken place after the on-site inspection had started. In this case, the Board stated that it was not possible to determine whether the deletion process was carried out on the phones of all three employees, and if the deletion was made, it was not possible to detect when the operation was performed. Accordingly, the Board concluded that there was no room for imposing an administrative fine on A101.
The Arguments Stated in the Dissenting Opinion
Two Board members dissented from the decision of the Board, stating that the on-site investigation had been hindered or complicated.
In their dissenting opinion, they emphasized that the on-site inspection authority is the most important and effective means of obtaining evidence for the Board to reveal competition law violations and that due to the nature of an on-site inspection, they must be carried out suddenly, quickly and uninterruptedly, without informing the undertakings.
The dissent also noted that, despite the fact that log records are generally reliable and accurate, the log record of each transaction cannot be detected due to issues such as version incompatibility, up-to-dateness of the software, etc., especially in mobile phone reviews. They explained that while the existence of log records of the transaction allows an almost certain determination of the transaction, the absence of log records or the inability to obtain them cannot be claimed as proof that the transaction was not carried out. At this point, by referring to the Board’s previous decisions,[4] they emphasized that although the Board was unable to detect a log record, there were cases where it was concluded based on other evidence that an on-site inspection had been hindered or complicated as a result of the deletion from the mobile device.
The dissenting Board members also stated that apart from the log records, there was a lot of facts which can be considered as evidence indicating that the on-site inspection was hindered and complicated in this case.
For instance, the on-site inspection started with a delay, a mobile device which was under surveillance was processed without the experts’ permission and the employees alleged to have deleted WhatsApp application are senior-level employees who are the direct focus and target of the on-site inspection.
In addition, the Board members stated that redownloading deleted applications and examining them from the last backup does not eliminate the result of hindering or complicating the on-site inspection, since the deletion process is considered to be a prevention of on-site inspection in itself, regardless of the data being restored. Therefore, the Board members stated that the majority’s interpretation would encourage undertakings to delete data during on-site inspections.
For all of these reasons, the dissent concluded that the on-site examination conducted at A101 was hindered and complicated. Therefore, they stated that an administrative fine should have been imposed on the undertaking in accordance with subparagraph (d) of the first paragraph of Article 16 of the Law No. 4054.
Conclusion
The Board looks at the deletion of WhatsApp correspondence during on-site inspections as potential evidence of hindering or complication of an on-site inspection. Nonetheless, it is not always easy to determine whether WhatsApp correspondence was deleted before or during the on-site inspection. In the A101 decision, due to the absence of a log record for the deletion process, the Board concluded that the on-site inspection was not prevented. On the other hand, during on-site inspections, although the deleted data can be restored through the use of forensic devices or accessed through the devices of other people, there are other decisions of the Board where the deletion process is considered as hindering or complicating the on-site inspection. For this reason, the A101 decision is noteworthy as it reveals that the Board has diverged from its strict approach set forth in its previous decisions.[5] Hopefully, the Board’s upcoming case law will clarify which evidence can definitively prove the deletion of the WhatsApp application and correspondence and in which cases the deletion can be considered as proof of hindering or complicating an on-site inspection.
- The Board’s A101 decision, No. 22-28/464-187 dated 23.06.2022.
- In accordance with the Board's decisions No. 21-23/271-M dated 26.04.2021,, No. 21-26/325-M dated 20.05.2021, and No 21-57/796-M dated 25.11.2021, an investigation has been initiated against some undertakings operating as producers/suppliers and retailers operating in the FMCG sector, in order to determine whether Article 4 of the Law No. 4054 was violated.
- A log record is the process of automatically recording events, time, user name and type of action in an information system.
- The Board’s Medicana Samsun decision No. 21-31/400-202 dated 17.06.2021 and , the Board’s Çiçek Sepeti decision No. 21-27/354-173, dated 27.05.2021..
- The Board’s Eti decision No. 21-24/278-123 dated 29.04.2021 , the Board’s Unmaş decision No. 21-26/327-152 dated 20.05.2021, , the Board’s D-Market decision No. 22-03/35-16 dated 13.01.2922 and , the Board’s İGSAŞ decision No. 21-38/544-265 dated 12.08.2021..
All rights of this article are reserved. This article may not be used, reproduced, copied, published, distributed, or otherwise disseminated without quotation or Erdem & Erdem Law Firm's written consent. Any content created without citing the resource or Erdem & Erdem Law Firm’s written consent is regularly tracked, and legal action will be taken in case of violation.