About the Public Announcement

The Turkish Personal Data Protection Board (“Board”), by its Decision No. 2021/28 dated 12 January 2021, resolved to initiate an ex officio investigation into WhatsApp Inc.

According to the Board’s decision, the investigation aims to determine, among other matters, whether:

• the sharing of personal data with third parties during the data processing process violates Article 9 of the Law on the Protection of Personal Data No. 6698 (“Law”), which governs the transfer of personal data abroad based on the explicit consent of the data subject, as well as the requirement under Article 3 of the Law that explicit consent must be freely given;

• the consent required as a precondition for the transfer of personal data to another company located abroad violates the principles set forth in Article 4 of the Law, namely:

  • processing personal data in accordance with the law and the principles of good faith,

  • processing for specified, explicit, and legitimate purposes, and

  • processing in a manner that is relevant, limited, and proportionate to the purposes for which the data are processed;

• making acceptance of the updated user agreement a mandatory condition for accessing the service is compatible with the principle, repeatedly emphasized in the Board’s previous decisions, that explicit consent must not be made a condition for the provision of a service;

• the transfer of personal data abroad complies with the legal requirement that such transfers may only be carried out based on the explicit consent of the data subject or under the other conditions prescribed by the Law.

The Board also announced that a further evaluation of the matter would be conducted on 8 February 2021, and that the public would be informed of subsequent developments.

Commentary

The Law adopts a strict approach regarding the transfer of personal data abroad. Pursuant to Article 9, personal data may not be transferred outside Türkiye without the explicit consent of the relevant data subject, except where otherwise permitted by law.

The amendments introduced to WhatsApp’s user agreement provide that users’ personal data will be transferred abroad and processed accordingly. Users wishing to continue using the application are required to accept the updated agreement; otherwise, they will no longer be able to use the service. Furthermore, the agreement leaves unclear the identity and scope of the third parties with whom users’ personal data may be shared.

It is noteworthy that WhatsApp Inc., a company headquartered in the United States, introduced contractual terms that, at first glance, appear inconsistent with Turkish data protection legislation, which is largely based on European Union Data Protection Directive 95/46/EC. These changes attracted considerable international attention and became one of the most widely discussed data protection issues worldwide.

In this regard, it should be noted that the United States and the European Union have historically adopted different approaches to personal data protection. The European legal framework primarily views personal data as an extension of human dignity and fundamental rights, emphasizing the protection of the individual. By contrast, under the U.S. legal system, personal data has traditionally been regarded as an economic asset capable of forming the subject matter of commercial transactions.

As a messaging platform owned by Facebook Inc. (now Meta Platforms, Inc.), WhatsApp has once again highlighted the growing importance of personal data protection law in the digital age through its updated user agreement.

Finally, it should be emphasized that the outcome of the Board’s investigation is expected to further clarify the position of the Turkish Personal Data Protection Authority regarding the cross-border transfer of personal data, particularly transfers within multinational corporate groups, thereby contributing to the development of Turkish data protection practice in this area.