WhatsApp has sent a notification to its users, stating that users who do not accept the updated terms and privacy policy cannot use WhatsApp as of 08.02.2020. It also announced that its users in EU countries are exempt from this requirement.

The most basic difference of the update dated 04.01.2020 from the previous privacy policy of WhatsApp is at the point of using the personal data of its users. WhatsApp, which has the authority to collect data of its users before the update in question, will now be able to use this personal data collected from its users after the mandatory update. According to the information on WhatsApp’s website, among the information collected from the users of the application; Account information, messages, links, status information, transaction and payment data, customer support and other communications, usage and registration information, device and connection information, location information, cookies, information provided by the third party. The above listed data obtained by WhatsApp; services, safety, security and integrity, communications about Facebook companies and corporate communications. Therefore, as of 08.02.2020, the information of users who have accepted the update will be processed and used by Facebook and all other affiliates on WhatsApp by placing them on a legal basis.

As a result of this mandatory update imposed by WhatsApp on its users, for example, residence information that can only be recorded by the state will be within the scope of the location information sent via the application, it will be automatically shared with the application and other affiliated companies, even if the user does not want it. In this sense, by imitating the data sent via WhatsApp, it is technically easier for users to access their banking accounts without the will of the user. The mandatory update of the application also enables individuals to have their personal data “legally” even in possible future court proceedings.
At the same time, in the context of the update in question, the sharing of data via WhatsApp with Facebook and the fact that it will be shared with 3rd companies on Facebook poses serious risks for users. The fact that Facebook, which is being prosecuted for leaking millions of people’s data on this matter in an unlawful way, will be able to sell the data of the users with their “consent” with the said update is the evidence of this risk.

Finally, if we evaluate the update in the context of Turkish law, first of all, with the Constitutional amendment made in 2010, an additional clause was added to the 20th article of the Constitution, and personal data gained Constitutional guarantee within the scope of “right to privacy and protection of private life”. In the paragraph in question; “Everyone has the right to request the protection of personal data about him. This right; It also includes informing about personal data about the person, accessing these data, requesting their correction or deletion, and learning whether they are used for their purposes. Personal data can only be processed in cases stipulated by law or with the express consent of the person. The principles and procedures regarding the protection of personal data are regulated by law. ” provision is included. Secondly, in accordance with the provisions of Article 5 of the Law on the Protection of Personal Data, it is obligatory to give explicit consent for the processing of personal data. However, the approvals given / to be given by the users to the last update of WhatsApp cannot be accepted as legally valid in terms of Turkish law. Because, it has been stated that if the update is not approved until 08.02.2020, users who do not give consent cannot use the application. In other words, although users are not given an additional right of choice, a clear imposition has been made. In addition, explicit consent must be obtained separately for each of the data on sexual life, ethnic origin, political opinion, and similar data considered as “special quality personal data” within the scope of KVKK. Otherwise, “a single consent” given for such special data is not accepted as explicit consent in Turkish legislation. Thirdly, in accordance with the KVKK, it is necessary to have clear information about how these personal data will be processed, how to transfer them abroad, etc. However, in the new contract of WhatsApp, all of these issues can be freely transferred to any of our affiliates and we, We can transfer it to any of our affiliates, the organization taking our place, or to our new owner. ”

We, as Hesap Law Office, advise our clients to be careful in this regard and to act in parallel with the provisions of the law in question.

Asena Fulya SEYREKBASAN

Apprentice Attorney at Law