On September 3, 2021, following the Irish Data Protection Commission’s decision to fine fine Whatsapp EUR 225,000,000, Turkish Personal Data Protection Board (“Board”) has published a summary of its review of Whatsapp application, in which the Board has fined the company TRY 1,950,000 for failing to take necessary technical and administrative measures to ensure data security in violation of Article 12(1) of the Law on Personal Data Protection No. 6698 (“Law”).
First, the Board explained that Whatsapp states that different data processing conditions are used in terms of various personal data processing activities within the scope of the application in question and that the explicit consent requirement for personal data processing is an exception. However, since Whatsapp's Terms of Service defines itself as a contract with the user, it has been determined that the explicit consent of the relevant persons is obtained when the contract is approved. In its evaluation, the Board also took into account that a single explicit consent was obtained from users without the providing an option whether to consent to processing of personal data and transfer of data to third parties residing abroad by Whatsapp and that the processing and transfer activities were presented to the data subject in a single text inseparably, by placing a provision regarding the transfer in the contract. As a result of this evaluation, the Board decided that the element of “free will” of explicit consent was damaged. Further, it is emphasized in the ruling that, explicit consent was not obtained from users regarding the personal data processing activity to be carried out through cookies for profiling purposes.
Moreover, the Board evaluated that because the servers are not in Turkey, all processing operations performed on personal data (such as recording, storing, and transferring) after collecting such data from data subjects in Turkey result as the personal data being transferred abroad. As a result, such a transfer must comply with Article 9 of the Law, which governs the conditions for personal data transfer to abroad. In this context, considering that Whatsapp has declared that it does not apply to explicit consent in any way for data transfer activities to the Board and the necessary undertakings for data transfer abroad are non-existent, the Board decided that Whatsapp has not acted in accordance with Article 9 of the Law.
In conclusion, the Board decided to impose an administrative fine of TRY 1,950,000 on Whatsapp, which it determined did not take all kinds of necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of personal data.
Simge Kılıç, Esra Temur