As known, several months ago, Whatsapp Inc. had informed its users about the update on the terms of use and privacy policy and announced that “the users must consent to their WhatsApp data being shared with Facebook companies in order to continue using WhatsApp, otherwise as of February 8, 2021 they will not be able to use WhatsApp”. This update stirred a huge debate among users, and millions stopped using the app. That being said, on January 12, 2021, the Personal Data Protection Authority [“Authority”] initiated an ex officio investigation as to whether WhatsApp infringed Article 15 of Turkish Personal Data Protection Law No. 6698 [“Law No.6698”].
The Authority recently completed its examination on the Terms of Service of WhatsApp and imposed 1,950,000 TRY [one million nine hundred and fifty thousand Turkish Liras] fine on the company for failing to sufficiently protect user data, with its decision dated 03.09.2021 and numbered 2021/891. This is the highest penalty ruled by the Authority so far.
In its decision, the Authority also discussed the following and decided that the company is processing users’ personal data in violation of the Law No. 6698:
- The WhatsApp Terms of Service do not provide users with an optional right for the processing and transferring their personal data abroad. Accordingly, the “free will” element of the explicit consent has been infringed since explicit consents were not obtained
- The terms regarding the data transfer have been set non-negotiable. Thus, users are forced to provide consent to the contract as a whole.
- Since WhatsApp servers are not located in Turkey, the consent for all kinds of personal data transactions must be obtained explicitly from the users in the
Additionally, the Authority ordered WhatsApp to bring its Terms of Service and Privacy Policy in line with the Law No. 6698 within 3 [three] months and inform data subjects in this respect.
By Zahide Altunbas Sancak, Partner, and Sevinc Jafarova, Associate, Guleryuz & Partners