Turkey: KVKK launches investigation into Whatsapp application data processing and sharing activities
The Personal Data Protection Authority ('KVKK') issued, on 12 January 2021, a statement launching an investigation into WhatApp Inc.'s data processing and data sharing activities. In particular, the statement outlines, among other things, the relevance of a number of provisions of the Law on Protection of Personal Data No. 6698 ('the Law') including the conditions for the processing of personal data under Articles 5 and 6, general principles of processing data under Article 4 and the transfer of personal data under Article 9. In addition, the statement highlights the requirements for obtaining explicit consent in relation to the processing of personal data and for data transfers.
Moreover, the statement notes key considerations for the preliminary investigation into Whatsapp, which will specifically consider the collection of explicit consent for the processing of personal data and the transfer of personal data to other data controllers. The statement notes that, among other things, the investigation will consider whether the process for obtaining consent for the processing of personal data and for the transfer of data to third parties established abroad are substantively separate.
In addition, the investigation will focus on whether, in the case a user may not consent to their personal data being transferred to another data controller, while at the same time consenting to the processing of data, this shall result in a violation related to the collection of consent. Furthermore, the investigation will also consider if the application has violated the principles listed in Article 4 of the Law, namely, 'compliance with lawfulness and fairness,' 'being processed for specified, explicit and legitimate purposes,' and 'being relevant, limited and proportionate to the purposes for which they are processed.' Lastly, the investigation will also consider if there has been a violation of Article 9 of the Law regarding the transfer of personal data to data controllers established abroad.
You can read the statement here.