A Public Announcement was published by the Personal Data Protection Board stating that in order to send a verification code to consumers via text message in stores during shopping, the data controller must have fulfilled the obligation of information and obtaining an explicit consent under the Personal Data Protection Law.
The Announcement was published on the official website of the Personal Data Protection Board on 13 November 2023. The purpose of this announcement is to ensure compliance with the Law No. 6698 on the Protection of Personal Data (“Law”) by addressing the storage of customer phone numbers during purchases and the subsequent sending of commercial electronic messages to individuals without obtaining explicit consent.
As a result of the Board’s examinations, it has been determined that privacy policy was not provided, and explicit consent was not obtained in accordance with the law in or before the verification code was sent. In this context, in order to ensure the lawfulness of personal data processing processes for sending commercial electronic messages, an Announcement was made stating that explicit consent must be obtained and the obligation to inform must be fully fulfilled.
Notable line headings in the Announcement are as follows:
- The purpose and content of the SMS to be sent during the checkout process for purchases made in stores should be clearly and comprehensibly communicated to the data subjects. This information should be provided as a requirement of layered disclosure.
- It is asserted that the procedure of consolidating various transactions (such as consent for membership agreement, personal data processing, and commercial electronic messages) into a single action through SMS during payment transactions should be discontinued. Instead, explicit consent should be independently obtained for each distinct transaction.
- Obtaining explicit consent and fulfillment of the disclosure obligation by data controllers should be carried out separately from each other.
- In SMS messages sent to obtain explicit consent for sending commercial electronic messages, the explicit consent to be obtained must encompass all the elements specified in the Law.
- Explicit consent for the processing of personal data for the purpose of sending commercial messages should not be presented as a mandatory element for the completion of the purchase. Otherwise, it may cause violation of the principles of “being based on information and being disclosed with free will”, which are among the elements of explicit consent.
- The explicit consent for the processing of personal data to send commercial electronic messages should be requested after the completion of a purchase. This approach ensures that the explicit consent for commercial electronic message permission is not perceived as an essential component of the transaction.
The full text of the Announcement is available at this link. (Only available in Turkish).
