|
|
Introduction
For a couple of days, Turkey is talking about the changes in the user contract of the Whatsapp which has 2 billion users worldwide, and almost 50 million users in Turkey. With the warning sent to WhatsApp users by Whatsapp Inc, users were informed about that the terms of use of the application were updated to include consent to the processing and to transfer of personel data of users to suppliers, business partners, service providers and other third parties located abroad, and users were also warned about that users who do not give consent cannot use this application and that their accounts will be deleted on 8 February 2021.
The update warning, which includes the collection, processing and use of more data by Whatsapp Inc, caused panic of Whatsapp users, causing everyone to look for a more secure messaging platform. In addition to the search for a safe platform for Whatsapp users, the Turkish Competition Authority and the Turkish Personal Data Protection Authority took the issue on their agenda and initiated investigations ex officio.
Turkish Competition Authority and Whatsapp Inc.
With the decision of the Competition Authority dated 11.01.2021 and numbered 21-02 / 25-M, the Authority decided ex officio to investigate Facebook Inc., Facebook Ireland Ltd., WhatsApp Inc. and WhatsApp LLC, about the obligation to share data imposed on WhatsApp users to determine whether there has been a violation of Article 6 of the Turkish Law No. 4054 on the Protection of Competition.
6th Article of the Turkish Law No.4054 states that “It is unlawful and prohibited for one or more undertakings to abuse their dominant position in the market of goods or services in the whole or part of the country, either alone or through agreements or collective behaviors with others”. By this article, abuse of dominant position is prohibited in Turkey.
It is an obviously abuse of dominant position that the warning sent by Whatsapp to the users who also consumers of the service states that if users will not approve the new conditions related to processing and transfering of their personal data, then they can not use application after 8th February 2021. In this case, it is an appropriate decision for the Competition Authority to initiate an investigation ex officio.
The competition authority has decided to take interim measures within the framework of Article 9 of the Law No. 4054, since these practices have the possibility of causing serious and irrecoverable damages until the final decision to be taken as a result of the investigation. The decision taken further until a final decision to be taken, it has been decided in Turkey that Facebook should stop the terms of use for other services and notify all users ,who accept these conditions or do not accept these conditions that Facebook has stopped the new conditions involving data sharing by the date 8th February 2021.
Personal Data Protection Authority and Whatsapp Inc.
15th article of the Turkish Personal Data Protection Law states that “The Authority, upon complaint, or ex officio, if it finds out about the alleged violation, makes the necessary examination on the matters that fall into its field of duty”. By this provision of law, Personal Data Protection Authority has been given the authority to conduct an ex officio investigation in case the alleged violation is learned. So, Turkish Personal Data Protection Authority, with its decision dated 12.01.2021, announced on its website that it started an investigation of the change that the Whatsapp application will make in the user agreement.
In the announcement made by the Authority, results of the preliminary assessment, regarding obtaining express consent for the processing of personal data and transferring it to other data controllers abroad by Whatsapp Inc which is a data controller located abroad, listed such as:
- Considering that the process of obtaining consent from users for the processing of personal data and transferring it to third parties residing abroad is not separated, and taking in to account that users may give consent to processing of their personal datas but users may not consent to transferring of their personal data to another data controller abroad, and also considering the prevalence of use of the application in question, whether it constitutes a violation in terms of “disclosure with free will” which is one of the elements of the explicit consent specified in the Law,
- Whether allowing the use of the application on condition that it is transferred to another company located abroad. constitutes a violation in terms of the principles of “compliance with the law and good faith”, “processing for specific, explicit and legitimate purposes” and “being connected, limited and proportionate to the purpose for which they are processed” are among the principles listed in Article 4 of the Law,
- Considering that the fact that the service provided on condition is subject to explicit consent may impair the given consent and this situation may result in the unlawful processing of personal data, whether the service is subject to consent with the update made by Whatsapp Inc,
- Whether there is a violation of the provisions of Article 9 of the Law regarding the transfer to be made by WhatsApp Inc to data controllers located abroad
Regarding these issues, the Personal Data Protection Authority has announced the decision dated 12.01.2021 and numbered 2021/28, it has been decided to initiate an ex officio investigation against WhatsApp Inc. Regarding the process, a new evaluation will be made by the Board on 08.02.2021.
The Problem of Explicit Consent
As it is known, in the Personal Data Protection Law No.6698, one of the processing conditions in Articles 5 and 6 of the Law must be present in order to process personal data. In the absence of processing conditions, personal data can only be processed upon the explicit consent of the data subject.
In Article 3 of Law No. 6698, explicit consent is defined as “It refers to the consent of a specific subject, based on information and declared with free will”. In this case, in accordance with the Law, there are three elements of the express consent to be given by the data subject:
- Being related to a specific subject
- Being based on information
- Disclosure of free will
The explicit consent given by the data subject will not be deemed legally valid without carrying these elements, in other words, without knowing what subject it is related to and without being informed about the subject, and in cases where there are issues that would impair his free will.
In the summary of the Decision of the Personal Data Protection Board dated 16.02.2018 and numbered 2018/19, the explicit consent to be imposed by the data controller as a condition of the membership and service of the contract, therefore;
- Obtaining explicit consent in the presence of other personal data processing conditions will mean the abuse of the right by the data controller due to the misleading and misleading of the person concerned,
- In addition, the fact that the service is subject to express consent as a condition will hamper the express consent,
According to these facts, Turkish Personal Data Protection Authority has decided to impose administrative sanctions on the data controller who did not fulfill the obligation to take administrative measures regarding to take technical and scientific methods for ensuring data security within the framework of paragraph (1) of Article 12 of the Law, due to the fact that this situation violates the rules of honesty and principles of being bound, limited and proportionate for the purpose of processing complying with the law in Article 4 of the Law.
In this case, considering the fact that the users will not be able to use the application after 8 February 2021 who do not give express consent to the contract change regarding the collection, processing and use of more data by Whatsapp Inc.; it is obvious that the service provided by the Whatapp Inc to its users is subject to express consent as condition and therefore the express consent given in this way is not legally valid due to the impairment of free will.
