Turkey: Personal Data Protection Authority and Competition Authority Launch Probes into Changes in WhatsApp Privacy Policy

(Feb. 8, 2021) Changes announced on January 6, 2021, by the popular instant messaging service WhatsApp conditioning its use on consenting to the transfer of certain user data to other Facebook companies appears to have caused widespread and severe criticism among its Turkish customer base. Media reports indicate that, as a result of the announcement, approximately 2 million Turkish users have abandoned the app to download alternatives, including local messaging applications. At least one Turkish data protection expert has condemned WhatsApp’s move as “domineering,” pointing out that WhatsApp’s new policy is not applicable in the European Union (EU), where the data of users are protected under the EU’s General Data Protection Regulation. The controversy has prompted the Turkish Competition Authority and Personal Data Protection Authority to launch a probe into whether the changes in the policy violate Law No. 4054 on the Protection of Competition and Law No. 6698 on the Protection of Personal Data.

On January 11, the Competition Authority (CA) announced that it was launching an investigation into Facebook, Inc., Facebook Ireland Ltd., WhatsApp Inc., and WhatsApp LLC (collectively Facebook). The CA cited article 6 of the competition protection law prohibiting the abuse of dominant market position. Citing the possibility of irreparable harm, the CA also issued a preliminary measure ordering Facebook to temporarily suspend the implementation of any changes in WhatsApp’s privacy policy for Turkish customers.

On January 12, the Personal Data Protection Authority (PDPA) announced that it was starting an investigation into WhatsApp Inc.’s conduct in changing the privacy policy. The PDPA stated that it will look into whether the changes in the privacy policy and the fact that users are required to consent to the transfer of their data to third-party data controllers located abroad violate the protections of article 9 of the personal data protection law, which requires the explicit and informed consent of the data subject for data transfers to foreign countries where certain appropriate safeguards are not provided or an adequacy decision has not been issued by the PDPA. The PDPA also stated that it will inquire whether conditioning the use of WhatsApp on consenting to the transfer of data to foreign third-party controllers violates the data protection principles of “lawful and fair processing,” “processing for specified, explicit, and legitimate purposes,” and “processing that is adequate, relevant and limited to what is necessary” enshrined in article 4 of the personal data protection law.

Furthermore, President Recep Tayyip Erdogan’s office reportedly decided to move its online messaging groups from WhatsApp to another local encrypted messaging app following the changes in the privacy policy.

Because of the backlash against the changes in the privacy policy in various countries around the world, WhatsApp has recently posted an FAQ addressing the issue in an effort to clarify its new policy.

Join Our Team

Subscribe Now

Get updates by subscribing to our newsletter