Turkey: Explicit Consent And Blanket Consent Concepts

Conditions for the processing of personal data are regulated various fields in Turkish Law. First of these, article 20 of the Constitution of the Republic of Türkiye, titled "Privacy of Private Life" states that "Personal data can only be processed in cases stipulated by the law or with the explicit consent of the person." statement is included.

In addition to the Constitution, in article 5 of the Turkish Personal Data Protection Law ("KVKK") No. 6698, titled "Conditions for Processing ofSpecial categories of personal data" and in article 6 titled "Conditions for the Processing of Sensitive Data". However, while auditing the compliance of the data processing activity with the law, article 4 of the KVKK titled "General Principles" should also be taken into account.

In article 5/1 of the KVKK, "Personal data cannot be processed without the explicit consent of the data subject." and in article 6/2, "It is prohibited to process theSpecial categories of personal data without explicit consent of the data subject." statements are included.

When the Turkish Personal Data Protection Law and other regulations in Turkish Law are evaluated together, the processing of personal data is prohibited as a rule, but in exceptional cases stipulated in the KVKK and in cases where the explicit consent of the data subject is available, data processing will become lawful.

What is Explicit Consent?

The concept of explicit consent is stated in article 3/a of the KVKK as "Consent related to a specific subject, based on information and expressed with free will." has been defined as. As can be understood from the literal of the KVKK, the concept of explicit consent has three main elements.

• Being on a specific subject

  In order for the consent declared by the data subject to be valid, the consent must be related to and limited to a specific subject. It is necessary to clearly state on which subject the explicit consent declaration was taken by the data controller and the data processor. Accordingly, with a general statement of will, "I accept the processing of my personal data." an open-ended and indefinite explicit consent is not considered as "explicit consent" in the context of the KVKK on its own.

• Being informative

  Although explicit consent is essentially a declaration of will by the data subject, in order to freely given explicit consent, the person must know what he /she explicit consents to. This situation is also related to the concept of "obligation to inform" regulated in Article 10 of the KVKK. The data subject must have full knowledge not only on the subject of the explicit consent, but also of the consequences of his/her explicit consent.

• Free will declaration

  The concept of explicit consent, which is expressed as a statement of will of the person, will be valid if the person is aware of his/her behavior and has his/her own decision. Any act that will injure the will of the person will also cripple the consent given for the processing of personal data. In order to talk about free will, it is necessary to be sure that the person has a "right to choose". The data subject should not be exposed to negative consequences if he/she does not express his/her consent.

What is Blanket Consent?

Within the scope of KVKK, explicit consent means that the data subject consents to the processing of his/her data, voluntarily or upon request from the other party. Explicit consent also determines the limits, scope and duration of the data that the data subject allows to be processed.

Explicit consents of a general nature, which are not limited to a specific subject and not limited to the relevant transaction, are considered as "blanket consents" and are considered legally invalid. Consent statements that do not indicate a specific subject and activity such as "all kinds of commercial transactions, all kinds of banking transactions and all kinds of data processing activities" can be considered as blanket consent.

For example, "Your name, surname, telephone number and e-mail information will be transferred to our business partners residing abroad for the purpose of supplying products and services, so that you can be informed about our campaigns, and SMS can be sent to you for the purpose of advertising and promotion of our products and services" under a phrase such as "I approve." checking the option will not mean that the explicit consent was obtained in accordance with the KVKK. In the example in question, since there are more than one personal data processing activity with different purposes from each other, it is necessary to offer a separate option for each activity.

In the Decision of the Personal Data Protection Authority dated May 20, 2020 and numbered 2020/404, it is stated that "The consent given by the data controller cannot be considered as a valid explicit consent since the KVKK Working Deed of Consent is obtained from the employees electronically, the said consent is very comprehensive and there is not sufficient illumination, the consent to be given is "blanket consent", and the possibility of not giving consent is not effectively presented to the worker." The Authority has decided to impose an administrative fine of 50,000 TRY on the data controller due to non-fulfillment of the obligation to inform and 200,000 TRY for the data controller's failure to take the administrative and technical measures required under the KVKK.

Is It Possible to Withdraw Explicit Consent?

Although there is no provision in the KVKK on this subject, in accordance with Article 6/2 of the "Regulation on the Deletion, Destruction or Anonymization of Personal Data" ("Regulation"), in cases where the processing of personal data is carried out only on the basis of explicit consent, it is accepted that the conditions for the processing of personal data cease to exist if the data subject withdraws his/her explicit consent. Therefore, with the interpretation of the article of the Regulation, it is accepted in the Doctrine that the data subject has the right to withdraw their explicit consent.

Withdrawal of explicit consent does not invalidate the data processing activities carried out up to that point. However, since the legal basis of the data processing activity will have disappeared from the moment the explicit consent is withdrawn, it is necessary to terminate the data processing activity and, if there is no legal basis for the retention of the data, the data obtained based on the explicit consent must be destroyed.

What Are the Situations in Which Explicit Consent is Not Required in the Processing of Personal Data?

Even if there is no explicit consent of the data subject for the processing of personal data, under the conditions stipulated in the KVKK, the personal data processing activity becomes lawful. These reasons, which are described as reasons for compliance with the law, are listed in article 5/2 of the KVKK. These are as follows,

• It is clearly provided for by the laws.
• It is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his consent or whose consent is not deemed legally valid.
• Processing of personal data belonging to the parties of a contract, is necessarily provided that it is directly related to the conclusion or fulfilment of that contract.
• It is mandatory for the controller to be able to perform his legal obligations.
• The data concerned is made available to the public by the data subject himself.
• Data processing is mandatory for the establishment, exercise or protection of any right.
• It is mandatory for the legitimate interests of the controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.

However, in article 6/2 of the KVKK, which is regulated under the title of "conditions for processing of sensitive personal data", the reason for compliance with the law, which enables the processing of sensitive personal data without the need for explicit consent, is explained. Accordingly, sensitive personal data other than health and sexual life are among the sensitive personal data may be processed without seeking explicit consent of the data subject, in the cases provided for by laws. Personal data relating to health and sexual life may only be processed, without seeking explicit consent of the data subject, by any person or authorized public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

As a result, data processing activities should be carried out in accordance with the regulations within the scope of the General Principles and Conditions for the Processing of Personal Data of KVKK. In this context, the "blanket consent" obtained without limitation in terms of the purpose and scope of the data processing and the subject is contrary to the clarification obligation in terms of KVKK.

You can access the information article titled Explicit Consent published by the Turkish Personal Data Protection Authority here (In Turkish).