INSIGHTS
In The Know.

  • Home
  • Insights
  • The WhatsAppocalypse continues: Turkish Data Protection Authority initiates an investigation against WhatsApp

Search by

The WhatsAppocalypse continues: Turkish Data Protection Authority initiates an investigation against WhatsApp

January 2021 – After the Turkish Competition Board announced the launch of an ex-officio investigation against WhatsApp and Facebook on 11 January 2021, the Turkish Personal Data Protection Authority (the “Authority”) had announced that it would also evaluate WhatsApp’s new privacy policy. At a meeting held on 12 January 2021, the Authority announced that it has initiated an ex-officio investigation against WhatsApp Inc.

The public announcement made by the Authority highlights that WhatsApp Inc. has updated its terms of use to include the obligation of users who want to use the application to consent to their personal data being processed and transferred to third parties abroad, and that users who do not consent will not be able to use the application and that their accounts will be deleted.

The Authority also states in its public announcement that while the privacy policy provided by WhatsApp to its users includes which data will be processed for which purposes, there are vague expressions such as “Facebook group companies, suppliers, business partners, service providers and other third-party data controllers located abroad as the transfer party”. The privacy policy also includes vague expressions regarding the purposes of data transfer. For example, purposes such as providing technical support, delivery and other services to parties conducting research, marketing and surveys etc.

Correspondingly, due to these ambiguous statements and the service being subject to explicit consent, in its preliminary assessment the Authority decided to initiate an ex-officio investigation to address the following issues:

  • Whether the explicit consent to be obtained from users includes both the processing of and the transfer of personal data to third parties residing abroad. Although users are able to consent to their personal data being processed, they are not able to deny consent for the transfer of this data. Accordingly, the Authority will assess whether this constitutes a violation in terms of the consent being disclosed with “free will", since it takes away the possibility of denying consent to the data being transferred abroad.
  • Given that using the application is subject to the condition of consenting to personal data being transferred abroad, whether this complies with (i) the principle of lawfulness and good faith (bona fide), (ii) the principle that personal data must be “processed for specific, clear and legitimate purposes (“transparency”) and (iii) the principle of "being connected, limited and proportionate to the purpose of processing" ("data minimisation") which are the basic principles of Person Data Protection Law numbered 6698 (the “Law”).
  • Whether the service provided is subject to consent with the privacy policy, which was updated on the grounds that the service being subject to explicit consent may harm the free-will of data subjects.
  • Whether the data transferred abroad is transferred as stipulated by the Law (explicit consent / commitment for third parties residing abroad to have sufficient safeguards).

Together with the launch of an investigation regarding the above-mentioned issues, the Authority also announced that a new assessment will be made on 8 February 2021, which is the last day under WhatsApp’s terms of use for users to approve the new Privacy Policy in order to use the application.

Several administrative monetary fines have been previously imposed on Facebook as a result of ex-officio investigations carried out by the Authority (Facebook faced administrative fines amounting to TRL 1,150,000 (approximately EUR 127,780) for the violation and TRL 450,000 (approximately EUR 50,000) for late notification of the violation in the Decision dated 18 September 2019 and TRL 1,100,000 (approximately EUR 122,220) for the violation and TRL 550,000 TL (approximately EUR 61,000), for late notification of the violation in the Decision dated 11 April 2019). Currently WhatsApp Inc., a subsidiary of Facebook, is facing increasing scrutiny from the Authority. The fact that the Authority will conduct a re-evaluation on 8 February 2021 can be interpreted as the belief that WhatsApp will take a step back. Given that many Turkish users have already switched to other platforms, whether WhatsApp will take a step back as a result of the investigations initiated by the Turkish authorities is highly anticipated. In any event, the decision will be a landmark case for Turkish Data Protection Law.

For more information please contact Associates Ceren Ceyhan, at cceyhan@gentemizerozer.com, or Sıla Dilaver, at sdilaver@gentemizerozer.com.