Adopting Explicit Consent of Data Subject Regarding Processing and Transferring Personal Data 13 October 2017
I. Processing and Transferring Personal Data
The Law on Protection of Personal Data numbered 6698 (“the Law”) defines processing personal data as “All operations performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic mean.”
As can be seen by the definition of the Law, transferring the personal data is included in the operation of processing data. However; within scope of the Law, transferring and processing personal data are regulated under different articles. The conditions of processing personal data are subject to Articles 4 and 7 of the Law while conditions of transferring personal data are subject to Articles 8 and 9.
In this manner; although there are differences between processing and transferring personal data, the mutual point is seeking the explicit consent of data subject. Accordingly; Article 5 of the Law states that personal data shall not be processed without explicit consent of the relevant party and Article 8 of the Law regulates that the personal data shall not be transferred without explicit consent of the relevant party.
II. The Explicit Consent of The Relevant Party (The Data Subject)
According to the Law; obtaining explicit consent of the data subject is obligatory for transferring and processing personal data apart from some exceptions. Notwithstanding that; there is not particular regulation regarding the procedure related to the obtaining explicit consent. However; in the informative publications of Personal Data Protection Institution (“KVKK”), it is stated that the explicit consent shall not be general and it must be clearly and specifically aimed at which purposes the data shall be used for and the explicit consent shall be given freely.
Besides; obtaining explicit consent is not sufficient and the explicit consent shall be taken after adequately informing the data subject and upon his free will. Additionally; although obtaining explicit consent is not subject to any legal form; it would be beneficial in terms of evidence law if the explicit consent is taken in writing.
Moreover; it is regulated that the explicit consents taken before the date of promulgation of the Law which is 07.04.2016 shall be valid provided that they are compatible with main principles and there is no opposing declaration of intention in one year.
III. Conclusion
In the light of the above mentioned explanations, the data controllers who process data should act in accordance with the obligation of obtaining explicit consent of the data subject, which is one of the various obligations regarding the processing and transferring personal data stated by the Law. Otherwise; they might be subject to the sanctions regulated under the Fifth Section of the Law headed “Crimes and Misdemeanors”. Consequently; the data controllers should make sure about that required documents for obtaining explicit consent are prepared and these documents meet the requirements specified in the Law and informative publications of KVKK. Therefore; it would be beneficial for the related parties to have professional support from experts of this matter.
Türkçe Versiyonu İçin
