KVKK announced the Public Announcement on the Use of Personal Data Obtained from Third Parties for Advertising and Marketing Purposes on the institution’s website.
In the announcement, it was stated that various notices and complaints were made to the institution regarding data controllers operating in various sectors using the contact information they obtained from their customers or third parties for advertising and marketing purposes.
The announcement emphasized that the fact that personal data was obtained from third parties does not provide a direct legal basis for data controllers to process this data for advertising and marketing purposes, and pointed out that these activities must be carried out in accordance with the Personal Data Protection Law No. 6698.
The announcement noted that the purpose of Law No. 6698 is to protect the fundamental rights and freedoms of individuals in the processing of personal data and to regulate the procedures and principles that real and legal persons who process personal data must comply with.
“Pursuant to the law, as a rule, personal data cannot be processed without the explicit consent of the relevant person, but if one of the legal processing conditions listed in Article 5 of the Law is met, it is possible to process personal data without the explicit consent of the relevant person. In this respect, it should not be forgotten that the personal data processing condition in terms of advertising and marketing activities should be evaluated separately for each concrete case.
On the other hand, in accordance with Article 10 of the Law, data controllers, during the acquisition of personal data, can; “It is obliged to inform the data controller about the identity of the data controller, the purpose of processing personal data, the persons and purposes to whom the processed personal data can be transferred, the method and legal reason for collecting personal data, and the rights of the relevant person under the Law.”
– “First of all, the obligation to inform must be fulfilled, and then explicit consent must be obtained.”
In KVKK’s announcement, it was stated that the procedures and principles to be applied in cases where personal data are not obtained directly from the relevant person are regulated in the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Notification Obligation.
In the announcement, it is stated that despite the regulations in the Communiqué, direct marketing calls are made through call centers with contact information obtained from third parties. “Data controllers must first fulfill their obligation to inform, and then, when necessary, obtain the explicit consent of the relevant person through a separate statement of intent.” expressions were used.
In the announcement, it was stated that it is mandatory for personal data processing activities to be carried out in accordance with the law, and the following 6 articles and warnings were listed:
“- In cases where personal data cannot be obtained directly from the relevant person, fulfilling the obligation to inform in accordance with Article 6 of the Communiqué in a timely and proper manner,
– Informing the relevant persons clearly, understandably and completely about the processing processes of their personal data,
– In personal data processing activities based on explicit consent; Explicit consent must be on a specific subject, based on information and expressed with free will,
– The behavior of the relevant persons, such as continuing to listen to the campaign, not ending the conversation, requesting information or not responding to an SMS, is not considered a valid explicit consent on its own,
– In line with the provisions of the Communiqué, the obligation to inform and the processes of obtaining explicit consent are carried out independently of each other,
“In all personal data processing processes carried out within the scope of advertising and marketing activities, the provisions of the Law and relevant legislation must be complied with and the fundamental rights and freedoms of the persons concerned must be observed.”
In KVKK’s announcement, it was stated that administrative sanctions may be imposed within the scope of Article 18 of Law No. 6698 on data controllers who are found to have acted contrary to the obligations stipulated in the Law.
