The Personal Data Protection Board Announced Its Decision Regarding the WhatsApp Investigation Initiated Ex-Officio

% 0

The Personal Data Protection Board (“Board”) ex-officio initiated an investigation against WhatsApp LLC. (“WhatsApp”) with its decision dated 12.01.2021 and numbered 2021/28, as announced with our Client Alert dated 13.01.2021. The Board announced the Decision dated 03.09.2021 and numbered 2021/891 regarding the investigation. Within the scope of the Decision, the Board includes its findings and assessments on the WhatsApp Terms of Service and Privacy Policy with respect to transferring personal data abroad, obliging users’ consent to receive services and compliance with general principles.

The Board established and assessed that:

  • The “declaration with free will” component of the explicit consent was violated, as only single explicit consent was obtained from the WhatsApp users without offering alternative right to process personal data and transfer to third parties residing abroad, to present the processing and transferring activities to the data subject in a single text inseparably, and imposing it as a condition to the service,
  • The principle of “conforming with law and good faith” under Article 4 of the Law on the Protection of Personal Data (“PPDL”) was violated on the grounds that certain expressions regarding transfer under the WhatsApp Terms of Service and Privacy Policy were non-negotiable, and users are forced to give consent to the transfer as a whole, and the use of the application is conditioned to transfer,
  • The principles of “processing for specific, explicit and legitimate purposes” and “being related, limited and proportional” were violated on the grounds that explicit consent for the transfer of all processed data was requested and there was no clear information regarding which data will be transferred for what purposes,
  • Any processing activity performed on personal data obtained from persons in Turkey means the transfer of personal data abroad as long as the servers are not located in Turkey, however, WhatsApp did not obtain explicit consent for cross-border transfer activities or did not apply for a commitment to the Board, therefore, the rules regarding cross-border data transfers were not acted upon,
  • Explicit consent for processing personal data through cookies for profiling purposes was not obtained,

and imposed TRY 1,950,000 administrative fine pursuant to Article 18/1-b of the PPDL.

Finally, the Board decided to instruct WhatsApp to bring the Terms of Service and Privacy Policy that is used instead of the clarification text, in conformity with the PDDL and its secondary legislation.

You may find the full text of the announcement regarding the Decision here. (Turkish).

All rights of this article are reserved. This article may not be used, reproduced, copied, published, distributed, or otherwise disseminated without quotation or Erdem & Erdem Law Firm's written consent. Any content created without citing the resource or Erdem & Erdem Law Firm’s written consent is regularly tracked, and legal action will be taken in case of violation.

Other Contents

Legal Developments
The Regulation on Processing and Protection of Personal Data by the Social Security Institution was Published

The Regulation on Process and Protection of Personal Data by the Social Security Institution (“Regulation”) entered into force through its publication in the Official Gazette dated 19.02.2022 and numbered 31755.

Personal Data Protection 23.02.2022
Legal Developments
Regulation on Processing of Personal Data and Protection of Confidentiality in the Electronic Communications Sector was Published

Regulation on Processing of Personal Data and Protection of Confidentiality in the Electronic Communications Sector was Published

Personal Data Protection 4.12.2020
Legal Developments
The Personal Data Protection Board Ex-Officio Initiated An Investigation against WhatsApp

The Personal Data Protection Board Ex-Officio Initiated An Investigation against WhatsApp

Personal Data Protection 13.01.2021
Legal Developments
The Personal Data Protection Authority’s New Resolution

The Personal Data Protection Authority’s New Resolution

Personal Data Protection 19.01.2021
Legal Developments
The Board’s Decision Regarding Registration Obligation of Commercial Enterprises Affiliated to Associations, Foundations and Unions to the VERBIS has been Published

The Board’s Decision Regarding Registration Obligation of Commercial Enterprises Affiliated to Associations, Foundations and Unions to the VERBIS has been Published

Personal Data Protection 25.06.2021

For creative legal solutions, please contact us.