The Pulse — Edition 04: Regulatory Landscape in Data Protection Law

January 2026 | Başaran Law Firm

Austrian Supreme Court Emphasises Meta's Full Transparency Obligations

The Austrian Supreme Court (OGH) issued a significant decision confirming that Meta cannot satisfy a user's GDPR right of access with a "partial" response. Meta cannot limit its reply to the information visible in account settings. Instead, upon request, it must provide a copy of all personal data it processes about the user and, in an understandable manner, key transparency information such as the purposes of processing, the source of the data, and the recipients to whom the data has been disclosed.

A central takeaway of the ruling is that the right of access cannot be reduced to generic explanations. Simply sharing a link to a privacy policy or displaying only selected categories of data does not, in the Court's view, meet the substance of Article 15 GDPR. Users must be able to see the "full picture" of what data is held about them, which in practice requires companies to maintain workable data inventories and reliable records on data sources and disclosures.

The Court also touched on a key point in the ongoing debate around Meta's advertising model. For processing activities used for personalised advertising, the question of the appropriate legal basis remains highly relevant. The decision highlights that data obtained via third-party websites or applications may include special category data (for example, political opinions or health-related information). It signals that arguments such as "we do not intend to collect such data" or "we cannot technically separate it" should not be used to disregard these risks.

CNIL Data Breach Decision: MOBIUS Fined €1 Million

France's data protection authority (CNIL) imposed a €1 million fine on MOBIUS SOLUTIONS LTD, a former service provider to DEEZER, in connection with a data breach affecting DEEZER users. CNIL found that MOBIUS, acting as a data processor in the context of personalised advertising campaigns, failed to comply with GDPR requirements — particularly regarding sub-processor arrangements and post-contract data handling. The CNIL decision is dated 11 December 2025, and the CNIL's public announcement was published on 19 December 2025.

According to the CNIL, the incident began in November 2022, when DEEZER alerted the authority that user data had appeared on the "dark web" and that its former processor, MOBIUS, might be involved. The decision identifies three key infringements:

MOBIUS retained a copy of data relating to over 46 million DEEZER users after the contract ended, breaching the obligation to delete data once the service is completed;
MOBIUS copied and used DEEZER data to develop its own services without DEEZER's explicit instructions; and
MOBIUS failed to keep records of processing activities as required for processors.

Finally, the CNIL stated that the GDPR applied even though MOBIUS was not established in the EU, because the analysis, segmentation, and hosting of DEEZER users' data amounted to monitoring individuals' behaviour — making the CNIL the competent authority in this case.

Mandatory Account Creation for Users Should Be Limited

At its meeting on 4 December 2025, the European Data Protection Board (EDPB) published new guidance on when it may be legally permissible for e-commerce websites to require users to create an account before making a purchase. The EDPB stressed that online shops are visited not only to buy products, but also for purposes such as browsing or tracking promotions. It warned that forcing account creation can lead to unnecessary data collection and create additional security risks.

The EDPB's approach is clear. As a general rule, users should be able to interact with the website and complete their purchase even without creating an account. For this reason, the Board recommends that e-commerce websites offer users two options: shopping in "guest" mode without opening an account, or voluntary account creation left to the user's choice.

However, the Board also says that mandatory account creation is not completely prohibited, but it can be justified only in a limited number of situations — such as providing a subscription service or giving access to members-only offers. In every case, proportionality and justification are required.

The EDPB also announced at the same meeting that it had taken the Digital Omnibus proposal into preliminary review and that the EDPB and the EDPS would publish a Joint Opinion on this issue. The Board warned in particular that the proposed change to the definition of "personal data" could go beyond existing CJEU case law and carry the risk of weakening the fundamental right to data protection.

$10 Million Settlement in the Disney COPPA Case

In the United States, a federal judge approved a settlement requiring Disney to pay $10 million to close allegations that it allowed children's personal data to be collected unlawfully through child-directed content. According to the Federal Trade Commission (FTC), the case is based on claims that data was collected from children under the age of 13 who watched child-focused videos, without notifying parents and without obtaining verifiable parental consent. The FTC press release was published on 31 December 2025.

It was alleged that Disney did not label certain videos correctly; and that, because of this incorrect labelling, it enabled personal data to be collected from children under the age of 13 via YouTube and allowed this data to be used for targeted advertising to children.

Under the settlement approved by the court, Disney has three main obligations:

To pay a $10 million civil penalty for the COPPA rule violation;
To ensure compliance with COPPA, including informing parents before collecting data from children under 13 and obtaining verifiable parental consent for the collection and use of the data; and
To establish and operate a review programme that will regularly check whether videos uploaded to YouTube should be marked as "Made for Kids."

Amendment to the Regulation on Personal Health Data

With the new regulation, the rules on access to personal health data have been redefined. Access by physicians other than the family physician has been limited by duty, service relationship, and duration. Physicians working at the hospital where the person is hospitalised will be able to access the data until discharge, and emergency department physicians will be able to access the data only to the extent of emergency services.

In addition, within the scope of e-Nabız security preferences, access to past health data has, as a rule, been made subject to the individual's approval; however, in cases of hospitalisation and emergency situations, this limitation will not apply within the framework of KVKK Article 6(3).

With the amendment, it has become possible for the parent who is granted temporary custody during divorce proceedings to access the child's health data. Access has been enabled for caregivers to the health data of individuals who have a disability report; and, in cases of detention and imprisonment, an exception has been introduced for physicians' access because a verification code cannot be sent.

Lawyers' Access to Health Data Has Been Updated

With the amendment to the Regulation published in the Official Gazette dated 3 December 2025 and numbered 33096, the rule requiring that a power of attorney include a specific provision on explicit consent in order for lawyers to access their clients' health data has been repealed. This change does not remove lawyers' access to personal health data; on the contrary, it removes only the formal condition regarding access by making it possible to access health data also on the basis of a general power of attorney.

What Does the KVKK Board's Principle Decision on ID Photocopies at Hotel Check-in Emphasise?

The Personal Data Protection Board's "Principle Decision on the Recording of Photocopies of Turkish Republic ID Cards of Individuals Receiving Accommodation Services in the Tourism and Hospitality Sector" was published on 09.12.2025. It was decided that data controllers must destroy such documents in accordance with Article 7 of the Law.

KVKK – Latest Board Decision on the VERBİS Registration Obligation

With its Decision dated 25.12.2025, the Personal Data Protection Board clarified the application of the Board Decision dated 19.07.2018 and numbered 2018/87, as updated by the Board Decision dated 04.09.2025. Accordingly, for data controllers who do not keep books on the basis of the balance sheet method, the criterion of the annual financial balance sheet total will not be sought; in assessing the exemption from VERBİS registration, only the annual number of employees will be taken as the basis. This decision removes practical uncertainties by clarifying the scope of the VERBİS obligation for small-scale data controllers.

A Labelling Obligation Is Coming for Deepfake Content

The first step towards a criminal-law regulation on deepfake content has been taken. A draft bill proposing an amendment to Law No. 5651 has been submitted to the Turkish Grand National Assembly (TBMM). The proposal requires AI-generated audio, written, and visual content to include a clear and visible "artificial intelligence label."

Content providers that fail to comply with the labelling obligation may face criminal liability under TCC Article 217/A. The aim of the regulation is to prevent the risks created by unlabelled deepfake content in terms of public order and security, public perception, political processes, and information security.

*This newsletter is prepared solely for informational purposes and does not constitute any legal advice for a specific case or client.