Turkish Data Protection Authority ("DP Authority") fined TikTok for TRY 1.75 million as a result of an investigation commenced against TikTok due to various news and complaints.
The decision was published on DP Authority's website on March 1, 2023.
01 What does the decision say?
DP Authority's decision is summarized below:
- Prior to this update, the personal data of minors under the age of 13 were viewable, and minors' data were collected by TikTok without appropriate parental consent;
Based on the reasonings above, DP Authority;
- Fined TikTok for TRY 1.75 million and
- Instructed TikTok to:
- translate the terms of service into Turkish, and
02 Who must be concerned?
The decision is relevant to all data controllers who;
- process personal data of minors (especially those under 13 age),
- set cookies for profiling data subjects,
- use a language other than Turkish to provide privacy policies or terms of service to data subjects/users.
- use privacy notices:
- that do not include detailed information on processing activities, and/or
- for also obtaining explicit consent (i.e. as an explicit consent text).
03 Key takeaways to be considered
Key takeaways based on DP Authority's decision on TikTok are as follows:
- A data controller, whose services also target minors, should carry out a risk assessment for processing of minors' data;
- Although DP Law doesn't have a clear rule on processing of minors' personal data, after this decision collecting/processing of personal data of minors under the age of 13 without appropriate parental consent will constitute a risk;
- Privacy notice should include clear information on (i) the processed data, (ii) the purpose of processing and (iii) legal basis for processing (and also collection method, as per Turkish DP Law);
- Privacy notice and terms of service should be submitted to the data subjects in Türkiye in Turkish language;
- Explicit consent text must be provided to data subjects separately from the privacy notice/policy;
- Data controllers who carries out profiling activities by using cookies should rely on explicit consent.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.