BIG DATA & ANTITRUST

WhatsApp’s Privacy Policy in the Light of the Bundeskartellamt’s Facebook Decision and the Turkish experience

WhatsApp was acquired by Facebook in February 2014. It was unforeseen the massive relevance that both companies' combined data would eventually have for Facebook’s business model. We currently see a clearer perspective of the above in light of WhatsApp’s new privacy policy.

By Gözde Diktas

April 14, 2021

In early January of this year, all WhatsApp users received a notification with respect to its new terms and conditions and privacy policy. According to such notification, by granting your consent, your data would be fully integrated with Facebook. A refusal to accept the referred terms would be equal to the inability to use WhatsApp anymore. As network effects are important, WhatsApp could expect that most of the users would unquestionably accept these updates, but many persons preferred to migrate to different messaging applications promising to offer more privacy-friendly practices.   

While in the European Economic Area, WhatsApp is somewhat restricted to limitlessly sharing its data thanks to the General Data Protection Regulation (GDPR), this is not necessarily the case for other jurisdictions. This article will flag some key items to consider for Turkey, after a quick revision of a piece of case-law that sits data protection regulation together with antitrust law.

The Bundeskartellamt v. Facebook Case 

In the case Bundeskartellamt v. Facebook, the German Competition Authority started an investigation on Facebook for collecting user and device-related data from third-parties partnered with Facebook (including WhatsApp) and combining such data with information from the platform’s user account.

Facebook asserted that its conduct was performed legitimately by receiving users’ consents. But the Bundeskartellamt argued that for the collection of consent as a legal basis for data processing to be valid, it should not be granted under coercion. In other words, users were conditioned to accept the terms and conditions if they wanted to use the app. Consequently, the terms of use and privacy of Facebook were in breach of the principles enshrined in the GDPR.

In addition to the above, the conduct of Facebook constituted an abuse of dominance in the form of exploitative contractual terms. According to German case-law, where one contractual party is so powerful and it is practically able to dictate the terms of the contract, it can be considered as an abuse of dominance, in order to protect constitutional rights of the ‘weak’ parties to the agreement. In this context, Bundeskartellamt stressed that a violation of GDPR should be considered too a violation of constitutional rights since the GDPR protects the fundamental rights to privacy and the protection of personal data. 

The Bundeskartellamt pointed out Facebook’s market share and strong direct network effects preventing its users from switching to another social network. It additionally mentioned that other advertising platforms found it difficult to thrive in a market captured by Facebook. It was also with this case that a myth was challenged: that of free of charge services allowing the platform to dispose of the users’ data as it pleased them, where data becomes the token for exchange. 

This whole context comes to relevance when we look at WhatsApp’s situation: (i) a messaging application with massive outreach and, (ii) an inexistent wiggle room for the terms and conditions. Bundeskartellamt’s decision should be a route map when leading with what might be indeed abusive contractual terms that would prevent a user from connecting to the app. 

Turkey

Jumping to another jurisdiction, it is worth clarifying an enforceability point of the Turkish Competition Act (‘Law No. 4054’), where  in the absence of the Facebook Turkey office, the Turkish Competition Authority (“TCA”) is based on effect doctrine rather than the principle of territoriality.

Accordingly, all agreements, conducts and decisions restricting competition in any of the markets in Turkey could be subject to the Law. 4054. Therefore, even in the absence of physical presence in Turkey, any undertaking causing anti-competitive effects in Turkish markets could be investigated by the Turkish Competition Authority.

According to the 2020 Report by Gemius, Instagram has 40,080,825 users in Turkey and Facebook has 31,236,479 users. These figures are relevant as it is Facebook who owns WhatsApp. For messaging applications, WhatsApp has 50,038,812 users, Facebook Messenger has 29,602,803 users and BIP (local messaging application in Turkey operated by Turkcell) has 9,528,919 users.

With these figures in mind, the TCA filed a lawsuit and launched an investigation with the ex efficio decision numbered 21-02/25-10 dated 11/01/2021 on interim measures against Facebook for its recent implementation concerning data sharing preferences to detect whether there is an infringement under the Article 6 of Law No. 4054 on abuse of dominant position.

At this point, TCA has the authority to launch an investigation either with a preliminary examination on whether an in-depth investigation is required or without any preliminary examination based on Art. 40 of the Law No. 4054. However, in practice, TCA has mostly initiated investigations with a preliminary examination before launching a full-fledged investigation in an effort to collect information about the factual background of the allegations. 

Nevertheless, TCA this time initiated an in-depth investigation directly rather than following that two-step approach. Competition experts justify this decision by the position of the TCA to provide sufficient information on legitimate competition law concerns which need to be assessed in an in-depth investigation.

TCA also decided to implement preventive measures by obliging Facebook to withdraw WhatsApp's policy updates, meant to enter into force by February 8th, 2021 and notify its withdrawal from the latest update to its users who have already accepted the updated terms or received the notification.

According to Art. 9 /4 of Law No. 4054, where there is an objective possibility that the investigated conduct could cause significant and irreparable damage, the TCA may take measures, not going beyond the scope of the Board's final decision, to protect the situation prior to the investigated conduct. Once this authority is exercised, the TCA must provide adequate reasoning for its decision and persuasive indicators demonstrating the possible damages in the absence of the interim measure.

With respect to abuse of dominance, the competition authorities generally use comparative tools or value tests to determine whether a dominant undertaking has an exploitative strategy, and prove its possible harm. Abuse of dominance is regulated and prohibited by Art. 6 Law No. 4054 with several behaviors as examples of abuse of dominance.

In reference to exploitative abuses, restrictions in production, marketing or technical development for consumers' disadvantage is one of the counted examples, and unlike German legislation, there is no other Article than this regulating the criteria to rely on in determining abusive behaviors. Thus, the TCA published in 2014 the Guidelines on the Assessment of Exclusionary Abusive Conduct by Dominant Undertakings (“Guideline”). Exploitative conducts, however, were not in scope.

On the other hand, it should be also noted that the examples in Art. 6 are not counted as numerus clausus, and there are other examples just brought with the case-law, such as excessive pricing as an exploitative abuse. Turkish competition law does not foresee such detailed rules on deciding market power and abuse of dominance as German competition law, and the Guideline does not cover exploitative abuse, unlawful access (with respect to the privacy concerns) to data affecting competition by an undertaking. However, Turkish courts may determine exploitative abuse on the basis of existing case-law. 

Generally, TCA’s investigation is quite similar to Bundeskartellamt’s Facebook Decision. It was decided that subsidiaries of Facebook such as Instagram or WhatsApp can continue collecting data of users only separately if there is no real consent of users for their data to be processed by another subsidiary or Facebook. Even if it is currently hard to get a clear conclusion in a non-EU country without examining allegations in detail, it would not be wrong from the announcements and allegations to say that WhatsApp indeed attempted to abuse on the basis of its dominant position. 

Final note

As the loss of control over personal data is also regarded as a topic of interest for data protection authorities, the Turkish Data Protection Authority initiated an investigation against Facebook and WhatsApp on following bases;

• The consent mentioned in the policy update is demanded only for processing of the data, not for the transfer of data to  third parties abroad.
• Transfer of data to an undertaking in another country might be against the required elements in  Art. 9 of the Turkish Law on the Protection of Personal Data.
• Coerced consent may not be considered as “explicitly given” which is a minimum requirement of the Law before any processing is performed. 

It is very likely that as in the Turkish case, many other competition authorities start looking at the intertwined connection between antitrust law and data protection when, as in the case referred above, data becomes essential for the undertaker's strategy and potentially threatens fundamental rights for the sake of their own profit.

Gözde Diktas is a fresh lawyer admitted to the Istanbul Bar Association in Turkey. She experienced an international traineeship on Information Technology Law, Competition Law and Data Privacy (based on GDPR) in Ukraine, and is expecting to perform two more in Malta and Portugal. She studied the US. Common Law during bachelor program, and she has publications in the field of competition law and an international report on internet censorship. She is a researcher in Big Data & Antitrust Research Cycle in the Institute for Internet & the Just Society.  She is fluent in English and Turkish, and can communicate in French.