The Personal Data Protection Board (“Board”) having concluded its investigation ex officio (the “Investigation”) of certain updated WhatsApp’s service and privacy terms, made a public announcement (“Announcement”).
According to WhatsApp’s amended terms and conditions, the users were forced to provide their consent for the process and transfer of their personal data to keep using the application.
The Board examined WhatsApp’s terms and conditions and determined that the updated terms violate the codified principle that explicit consent must be of the consenting party’s own free will, and the explicit consent was intertwined with the terms and conditions. Therefore, the processing did not fulfill the condition that the personal data must be processed in compliance with law and rule of good faith.
On the other hand, as explicit consent was obtained for all data processing activities, and no information was given regarding the purposes of data transfer by WhatsApp. In this respect, the data processing was also found to violate the principle of being proportionate, related and limited.
The Board also determined that no valid explicit consent was obtained for cross-border data transfer and data processing via cookies for the purpose of profiling.
Based on these, the Board announced a record TRY 1,950,000 administrative fine on parent company WhatsApp LLC, and order to bring WhatsApp’s service terms into conformity with Turkish law.
The Announcement dated 3 September 2021 is available on the Board’s official website here. (Only available in Turkish)
