On January 4, 2021, Whatsapp Inc., the most widely used digital messaging application of Turkey, announced a change in its terms of use. This announcement received wide backlash from the public who are worried about the eventual use of their personal data. Taking notice of the backlash, on January 12, 2021, Personal Data Protection Board (the Board) published a public release regarding the Whatsapp Application’s new terms of use. The public release can be accessed on the website of the Board via this link.
The Board determined that Whatsapp Inc. has requested consent to the processing of personal data of the users who would like to use the Whatsapp application. In addition, the company requests consent to the transferring of personal data from the users within the context of the terms of use. The crucial part of the update is that the users, who do not give consent to the new terms of use, will not be able to use the application and their accounts will be deleted.
Upon evaluating new terms of use, the Board made the remarks based on Personal Data Protection Law no. 6698, (“Law”) specifically on explicit consent, regulated in Article 3 of the Law; general principles, regulated in Article 4 of the Law, and provisions for transferring of personal data aboard, regulated in Article 9 of the Law.
As a result of the preliminary assessment made on Whatsapp Inc., a data controller established abroad, obtaining explicit consent for the processing and transferring of the personal data to other data controllers established abroad, The Board decided to initiate an official investigation with the decision dated 12.01.2021 and numbered 2021/28 on the following issues:
Whether “not separately asking for explicit consent required for I) the processing of the personal data, ii) the transfer of the personal data to third parties established abroad” constitutes a violation in terms of “declaration by free will” which is a requirement of explicit consent specified in the Law,
Whether “permission to use the application only by giving explicit consent to transferring of personal data to a third party abroad” constitutes a violation in terms of compliance with general principles, especially, i) compliance with lawfulness and fairness, ii) being processed for specified, explicit and legitimate purposes, iii) being relevant, limited and proportionate to the purpose for which they are processed,
Whether “service providing subjected to the explicit consent” may result in the unlawful processing of personal data,
Whether “there is a violation of Article 9 of the Law”, principles for the transfer of personal data abroad, regarding the transfer to be made by Whatsapp Inc. to data controllers established aboard.
The Board announced to the public that a new evaluation would be made on February 8, 2021.