The Turkish Data Protection Board’s Whatsapp LLC Decision

The Turkish Data Protection Board (“Board”) announced on 3 September 2021 that it had imposed an administrative fine on Whatsapp LLC after concluding an ex-officio investigation concerning the controller's data processing and cross-border data transfer operations. 

The investigation was triggered following the update announced by WhatsApp LLC on its  “Terms of Service and Privacy Policy.” The update to the privacy policy had caused tremendous public controversy, mainly due to the request for explicit consent for processing and transferring WhatsApp application users’ personal data to third countries. About the update, the company also stated that users who do not give explicit consent would not be able to use the app, and their accounts would be deleted. Following the declaration of Whatsapp LLC, the Board initiated an ex officio investigation on WhatsApp in Turkey. 

Within the scope of the investigation, the Board detected that the data controller had obtained the explicit consent of the data subjects for data processing and transfer operations solely with the approval of the Terms of Service and Privacy Policy. The Board also ascertained that the provisions on data processing and data transfer are positioned inseparably in a single text by the data controller. According to the evaluation of the Board, the text does not provide clear information concerning which personal data will be transferred for what purposes. The Board also detected that the data controller had no explicit consent regarding the cookies used for profiling. Besides, it is understood from the company’s declaration that the approval of the contract was mandatory to use the application. 

Based upon these grounds, with the decision dated back to  September 3rd, 2021 and numbered 2021/891, the Board concluded that there was a violation of the general principles under the Personal Data Protection Law numbered 6698 during the implementation of the Terms of Use and Privacy Policy. The controller did not establish a legal basis for transfers abroad and the use of cookies. Furthermore, in the decision, the Board considered that the elements of free will were damaged in obtaining explicit consent for several reasons. Firstly, explicit consent was presented as a precondition for providing the service. Secondly, explicit consent was requested as a part of the contract contrary to expectations of the law. 

Hence, the Board imposed an administrative fine of TRY 1,950,000,00 on WhatsApp LLC and instructed WhatsApp LLC to bring the Terms of Service and Privacy Policy into compliance with the law within three months. According to the decision, Whatsapp also has to fulfill the obligation to inform under the law and the Communique` on Principles and Procedures To Be Followed In Fulfillment of the Obligation to Inform.

***

Special thanks to Burcu Gür for her contributions to this article.