Turkish Data Protection Authority Imposes an Administrative Fine of 1,750,000 TL Against Tiktok Pte. Ltd.

The decision summary regarding the Personal Data Protection Board Decision No. 2023/134 was published on the official website of the Personal Data Protection Authority on March 1, 2023.

Based on various news and complaints regarding the TikTok application that the explicit consent was not duly obtained within the scope of the Personal Data Protection Law No. 6698 ("Law"), that there are illegalities in obtaining and storing personal data and that there are many security vulnerabilities of the software, the Turkish Personal Data Protection Board ("KVKK") decided to initiate an ex officio review.

As a result of this examination, with the KVKK's Decision No. 2023/134 ("Decision"):

• Before the update made to TikTok's Privacy Policy in January 2021, by default, the profiles were displayed publicly and there was no limitation in interaction, which posed a risk within the scope of accessing the data of users in the sensitive age group, and also showed that sufficient measures were not taken to reduce the risks by identifying the risks regarding the users,

• In January 2021, before the update of the Privacy Policy in January 2021, the personal information of children under the age of 13 using the application was viewed and data was collected about children without appropriate parental consent,
• In the Confidentiality Agreement on the website of the data controller, all of the processing conditions stated in Article 5 of the Law on the Protection of Personal Data are stated, but no clear information is given about which personal data is processed for which purpose and based on which processing condition, and in this respect, the data controller has acted contrary to the principles of "processing for specific, explicit and legitimate purposes" and "being connected, limited and proportionate to the purpose for which they are processed" stated in Article 4 of the Law,
• When creating a TikTok account, it is stated that users will be deemed to have accepted the Terms of Service (Terms of Use) and Privacy Policy if they continue to create an account, however, while obtaining approval in the Terms of Service section, the relevant text has not yet been translated into Turkish, for this reason, the content is not presented to users in an easy-to-understand form and users may accept the terms of use without fully understanding them,
• There is no situation regarding obtaining explicit consent when creating an account on the platform or when creating and actively using an account,
• It has been understood that the data controller did not obtain explicit consent from the data subjects regarding the personal data processing activity carried out by using cookies for profiling purposes, and the personal data processing activity carried out within this scope is not in accordance with the law.

For the reasons stated above, since it was determined that the data controller did not take all necessary technical and administrative measures to ensure the appropriate level of security in order to prevent unlawful processing of personal data, it was decided to impose an administrative fine of 1,750,000 TL.

In addition, the data controller has to

• translate the Terms of Service into Turkish within one (1) month in order to inform the relevant persons correctly,
• bring the Privacy Policy texts in question into compliance with the Law within three (3) months in order to inform the relevant persons correctly,
• Since it is understood that the Privacy Policy is used instead of a disclosure text and does not carry the elements of a valid disclosure, it has been decided to instruct to make a disclosure in accordance with the provisions of Article 10 of the Law[1] and the Communiqué on the Procedures and Principles to be Followed in Fulfillment of the Disclosure Obligation.

You can reach further information here.

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr