Discussions that the Siri application recorded audio by opening itself, that this information was collected and given to third parties, have brought personal data protection regulations back on the agenda. Cybersecurity Expert Dr. Erdal Baş, emphasizing the legal regulations regarding the protection of personal data, noted that both companies and individuals who obtain, use, or transfer personal data to third parties without complying with legal regulations may face sanctions.
Lecturer Dr. Erdal Baş from Üsküdar Üniversitesi Institute of Science, Cybersecurity Master's Program, evaluated Apple, one of the US technology giants, agreeing to pay 95 million dollars in a class action lawsuit filed on the grounds that its voice assistant technology 'Siri' violated users' privacy.
Apple agreed to pay to prevent the lawsuit from dragging on, even though it did not accept the accusations!
Dr. Erdal Baş reminded that, according to information available in open sources, the Apple Siri lawsuit was filed as a class action and the agreement, which provides for a total of 95 million dollars to be paid to claimants, is awaiting court approval. “According to the agreement, a payment of 20 US dollars per device is foreseen, not exceeding 5 devices per person. The allegations underlying the lawsuit are that the Siri application sometimes recorded audio by opening itself, that this information was collected and given to third parties; and that users' consent was not obtained. Apple announced that it reached an agreement to ensure the judicial process does not continue, without accepting these allegations.”
The importance of personal data security!
Lecturer Dr. Erdal Baş, pointing to the legal regulations regarding the protection of personal data, continued as follows:
“Legal regulations regarding the protection of personal data, in broad terms, stipulate that personal data belonging to individuals can only be collected, transferred to third parties, and stored with explicit consent; that this data can only be used for the purpose for which it was obtained, and personal data cannot be collected beyond this purpose; that this data can only be used to a limited extent and for a limited time for this purpose; that when the purpose is achieved or the foreseen period ends, this data must be deleted, except for those that must be kept mandatorily; and that individuals who own personal data can withdraw their prior consent for data collection and storage, and can request their personal data to be updated, deleted, or anonymized.”
Individuals have the right to know which of their data is collected, stored, and used!
Dr. Baş also noted that both companies and individuals who obtain, use, or transfer personal data to third parties without complying with legal regulations regarding the protection of personal data may face sanctions. “Individuals have the right to obtain information about which of their data is collected, stored, used, or not subjected to these processes, to request correction or updating of their personal data, to withdraw previously given consents, and to apply to those who obtain and use personal data (their data controllers) for the fulfillment of similar operations. If these applications are not fulfilled within a certain period, a complaint can be made to the regulatory board (Personal Data Protection Board),” he said.
Individuals have the right to demand material and moral compensation for their damages
Furthermore, if certain rules set out in the regulations on personal data protection are not complied with, sanctions such as imprisonment and administrative fines may be imposed; Lecturer Dr. Erdal Baş, pointing out that individuals also have the right to demand compensation for their damages, both material and moral, concluded his words as follows:
“To prevent the unauthorized acquisition of personal data, it will be necessary to comply with the measures that should be taken for electronic information security. Besides observing the rules for internet and social media use and taking precautions against malicious software, it will be beneficial not to share personal data unless it is essential.”