For more information in Turkish: WhatsApp'tan Gizlilik Sözleşmesi
Decision of the Authority
The decision of the Authority states the following:
- A single explicit consent is obtained from the users without making distinction between processing personal data and international transfer of the personal data. The processing and transfer activities are presented to the data subject in a single text inseparably. This has been found to be against the condition that the consent must be freely given separately for each specific and explicit purpose.
- Although the apparent legal basis is the establishment of the contract, the actual legal basis is in the nature of obtaining explicit consent. The data controller is obtaining consent by incorporating it into the contract as a condition of service. This was also found to be against the condition that the consent must be freely given.
- As long as the servers are not located in Turkey, all kinds of processing mean international transfer of personal data. Therefore, it is obligatory to make the transfer in question in accordance with Article 9 of the Law titled "Transferring personal data abroad". The data controller did not receive explicit consent for transfer activities and did not provide an undertaking to the Turkish Data Protection Board to transfer data internationally. The data controller did not act in accordance with Article 9 of the Law.
- The data controller does not obtain explicit consent from the data subjects regarding the personal data processing activity to be carried out through cookies for profiling purposes. The processing activity carried out within this scope is not compatible with the Law.
For all the above the Authority
- fined WhatsApp with TL 1,950,000,
WhatsApp is not registered to the Data Controllers' Registry (VERBIS), yet. Failure to comply with such obligation also causes a fine. Due to the fact that the deadline for the registration is extended until December 31, 2021, the Authority did not make any evaluation on VERBIS obligation.
For more information please visit our Linkedin page - Deris Intellectual Property
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.