Correspondingly, due to these ambiguous statements and the service being subject to explicit consent, in its preliminary assessment the Authority decided to initiate an ex-officio investigation to address the following issues:
- Whether the explicit consent to be obtained from users includes both the processing of and the transfer of personal data to third parties residing abroad. Although users are able to consent to their personal data being processed, they are not able to deny consent for the transfer of this data. Accordingly, the Authority will assess whether this constitutes a violation in terms of the consent being disclosed with "free will", since it takes away the possibility of denying consent to the data being transferred abroad.
- Given that using the application is subject to the condition of consenting to personal data being transferred abroad, whether this complies with (i) the principle of lawfulness and good faith (bona fide), (ii) the principle that personal data must be "processed for specific, clear and legitimate purposes ("transparency") and (iii) the principle of "being connected, limited and proportionate to the purpose of processing" ("data minimisation") which are the basic principles of Person Data Protection Law numbered 6698 (the "Law").
- Whether the data transferred abroad is transferred as stipulated by the Law (explicit consent / commitment for third parties residing abroad to have sufficient safeguards).
Several administrative monetary fines have been previously imposed on Facebook as a result of ex-officio investigations carried out by the Authority (Facebook faced administrative fines amounting to TRL 1,150,000 (approximately EUR 127,780) for the violation and TRL 450,000 (approximately EUR 50,000) for late notification of the violation in the Decision dated 18 September 2019 and TRL 1,100,000 (approximately EUR 122,220) for the violation and TRL 550,000 TL (approximately EUR 61,000), for late notification of the violation in the Decision dated 11 April 2019). Currently WhatsApp Inc., a subsidiary of Facebook, is facing increasing scrutiny from the Authority. The fact that the Authority will conduct a re-evaluation on 8 February 2021 can be interpreted as the belief that WhatsApp will take a step back. Given that many Turkish users have already switched to other platforms, whether WhatsApp will take a step back as a result of the investigations initiated by the Turkish authorities is highly anticipated. In any event, the decision will be a landmark case for Turkish Data Protection Law.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.