The Personal Data Protection Authority (“Authority”) published the Information Note on Chat Robots (“Information Note”) on 08.11.2024. The Information Note defines chatbots and lists their usage areas. As stated in the Information Note, chatbots may process name, contact information, payment information, file contents, messages, social media information, IP address, access times, device information and cookie information. For this reason, the transparency of artificial intelligence chatbots is important in terms of personal data security. Adequate information should be provided on how and for what purposes the personal data processed by such applications are used, to whom they will be transferred, how long the data will be stored, the identity of the data controller and, if any, its representative, and the rights of the data subject. A proactive approach should be adopted to ensure accurate and reliable age determination for children and to prevent children from having negative experiences.

The Information Note also lists the things to consider when developing a chatbot application. A risk assessment should be conducted before starting to process personal data. Applications should be designed in accordance with the principle of accountability. Personal data should be processed in accordance with general principles and legislation and thus the obligation to inform should be fulfilled. Necessary technical and administrative measures must be taken for personal data security by adopting an approach in line with international standards.

Should you have any inquiries, please do not hesitate to contact us.