In the public announcement published by the Personal Data Protection Board ("Board") on the Board's website on 13.11.2023, it was stated that the Board had received many complaints and notifications that commercial electronic messages were sent to relevant persons during cashier transactions regarding the purchases made in stores, and that these notifications and complaints were reviewed by the Board within the scope of the Personal Data Protection Law No. 6698 ("Law"), and the issues to be considered in relation to such transactions were underlined.
Although the announcement refers to in-store transactions, we believe that the obligations described below can be applied by analogy to data controllers who engage in similar practices outside of the in-store environment.
- Background
Board previously issued an announcement on this issue on 17.12.2021, whereby it is stated that data subjects were being misled by the data controller through obtainment of explicit consent for commercial electronic messages, despite the fact that the data controller did not provide any clarification in the content of the SMS or before sending the SMS, and/or the code in question was requested on the grounds that it was necessary to complete payment transactions or update information.
In the aforementioned announcement, Board stated that; (i) the persons authorized by the data controller in the stores should clearly and understandably inform the data subjects about the purpose of the SMS to be sent to the data subject's phone, (ii) the necessary channels should be provided in the content of the SMS in order to fulfill the obligation to inform, (iii) the practices of performing different processing activities such as membership agreement, authorization to process personal data, authorization to send commercial electronic messages, etc. with a single action by sending a verification code via SMS should be terminated, (iv) explicit consent and obligation to inform should each be fulfilled separately, and (v) the explicit consent to be obtained should cover the elements stated in the Law1.
However, as a result of the notifications and complaints received, the Board published the announcement on 13.11.2023, which is the subject matter of this in information note, as it found that the said practice is continued by many data controllers.
- Additional Matters Highlighted in the Current Announcement
In addition to the matters stated in its previous announcement dated 17.12.2021, the Board stated in its current announcement dated 13.11.2023 that the explicit consent for the processing of personal data for the purpose of sending commercial electronic messages should be requested after the completion of the purchase, in other words, the explicit consent should not be a precondition for the completion of the purchase. Otherwise, the elements of "being based on information and being expressed with free will" of the explicit consent will be damaged and it will be invalid as it is presented as a precondition for the utilization of the product or service.
- Conclusion
Within the scope of the announcements dated 17.12.2021 and 13.11.2023 issued by the Board, although it is not contrary to the Law to obtain consent for commercial electronic messages by sending SMS in stores or to obtain explicit consent in other matters and to comply with the disclosure obligation, it is necessary to act in accordance with the announcements when conducting these transactions.
In many of its previous decisions, the Board has stated that making explicit consent a precondition of service is not compliant with the Law. In the context of these announcements, this condition, in particular with regard to the explicit consent to be obtained for the sending of commercial electronic messages, should be complied with. Similarly, the Regulation on Commercial Communications and Commercial Electronic Messages clearly states that the consent to be obtained for the sending of commercial electronic messages cannot be a precondition for the service. Therefore, it is important to comply with the issues specified in the announcements in order for the consent to commercial electronic messages to be obtained not only through stores, but also through different channels, and the explicit consent to be obtained in accordance with the Law in this regard.
Footnotes
1. Pursuant to Article 3 of the Law, the elements of explicit consent are: (i) being related to a specific subject matter, (ii) being based on information, and (iii) being expressed with free will.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
