| Decision of the Personal Data Protection Board Regarding WhatsApp Application |
| Personal Data Protection Board had been proceeded ex officio examination about the update of the Terms of Service and Privacy Policy, which is accepted as a contract with the user about WhatsApp (data controller), including the explicit consent of the users to the processing of their personal data and their transfer to third parties abroad. |
| Regarding the Processing of Personal Data |
| • A single explicit consent is obtained from the users without the optional right to process their personal data and transfer it to third parties residing abroad, however, the transaction that appears to be the approval of the Terms of Service damages the “free will disclosure” element of obtaining the explicit consent originally included in the contract. |
| • Since the processing of the data obtained is not proportional and limited to the purpose shown, there is a violation of the principles of “processing for specific, clear and legitimate purposes” and “being connected, limited and proportional to the purpose for which they are processed”. |
| • Personal data processing without explicit consent through cookies for profiling purposes is also not in compliance with the law. |
| Regarding Transfer of Personal Data Abroad |
| • The use of the application is subject to the condition of ‘transfer’, which excludes non-negotiable and open will, therefore ignoring the interests and reasonable expectations of users constitutes a violation of the principle of “compliance with the law and good faith”, |
| • Since the servers of the data controller are not in Turkey are transferring the personal data abroad, and the absence of an application for express consent and a letter of undertaking to the Board is not in accordance with Article 9 of Law on the Protection of Personal Data. |
| As a result of the explanations above, an administrative fine of TRY 1,950.000 was imposed on the data controller, who was found to have not taken all necessary technical and administrative measures to ensure the appropriate level of security. |