What Kind of Sanctions Are Implementing to the Companies Which Send Advertisment Messages Without Explicit Consent of the Data Subject ? 24 December 2018
The Personal Data Protection Board (“Board”) published the principle resolution numbered 2018/119 and dated 16.10.2018 (“Principle Resolution”) in the Official Gazette numbered 30582 and dated 01.11.2018 due to increasing number of complaints about the transmission of advertisement messages to email address or to mobile phones via SMS or calls without the explicit concent of the data subject and without complying with the provisions of Law on Protection of Personal Data no. 6698 (“LPPD”).
It is emphasized that data controller who want to send advertisement messages or data processors who want to process this data are obliged to comply with the requirements of Article 5 of LLPD. In accordance with Article 5 of LLPD , personal data cannot be processed without the explicit consent of data subject. Exceptions regulated in related article for which explicit consent is not required are as follows:
- Where the law explicitly states that data can be processed,
- Where it is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his consent or whose consent is not deemed legally valid,
- Where it is mandatory to process personal data of the parties of an agreement provided that it is directly related to the conclusion or execution of that agreement,
- Where it is obligatory for the data controller to perform his legal obligations,
- Where the data is made available to the public by the data sublect,
- Where it is compulsory for the establishment, exercise or protection of a right,
- Where it is used for the legitimate interests of the data controller provided that it will not violate the fundamental rights and freedoms of the data subject.
The Principle Resolution regulates that the data controllers who send advertisement messages via email, SMS or phone calls and data processors who use the data witout complying with the requirements of Article 5 of LLPD are obliged to cease such activities in compliance with Article 15/7 of LLPD.
On the other hand, Provisions of Regulation on Commercial Communications and Electronic Commercial Messages (“Regulation”) and Law on Regulation of Electronic Commerce (“E-Commerce Law”) must be taken into consideration along with the provisions of LLPD on the matter of the transmission of advertisement messages to email address or to mobile phones via SMS or calls.
In accordance with Article 6 of E-Commerce Law electronic messages can only be sent to recipients provided that their prior approval is obtained. This approval can be obtained in written or by using any kind of electronic devices. Under Article 5 of Regulation, written approval must be priorliy obtained for electronic messages sent by the service provider for the purpose of promoting his goods, enterprise or celebration and wish. Such approval is valid until the right of refusal is exercised.
Therefore, although the above-mentioned regulations require the expilicit consent in parallel with the provisions of LLPD; the consent for the advertisment messages and the processing of the personal data must be seperately obtained incompliance with the relevant regulations. Although it is seen in the practice that two situations are collected under the same title and a single consent is obtained for both situations, it is of great importance that consents required for processing and transmission of personal data and transmission of messages are obtained seperately.
Another matter stated in the Principle Resolution is that in accordance with article 12 of LLPD, data controller are obliged to take all necessary technical and organizational measures in order to prevent unlawfull processing of personal data and unlawfull access to personal data.
In case that personal data are processed by natural or legal person on behalf of the data controller, the data controller shall jointly be responsible with these persons. In case of the breach of such requirements, the data controller or data processor shall be fined for an amount ranging from 15.000 TRY to 1 million TRY.
Furthermore; it is stated in Priciple Resolution that if the data belonging to data subjects to which advertisement messages and calls were directed, were collected unlawfully, criminal complaint will be filled to Public Prosecution Office about the data collectors for the violation of Article 136 of Turkish Penal Code titled “Unlawful Giving or Obtaining Data”.
In this context, without prejudice to the exceptions set forth in Article 5 of the LLPD, serious sanctions such as the initiation of criminal investigation and an administrative fines of up to 1.000.000 Turkish liras about data controllers and data processors in concern with the advertisement messages without the express consent of the data subject. For all these reasons, in order not to be imposed to these sanctions, it is required to be extremely careful and take a support from a lawyer for the validity and explicitness of consents to be obtained from the data subject.
Türkçe Versiyonu İçin
