Turkish DPA Warns with Principle Decision on Promotional Communications

On
November 1, 2018, Personal Data Protection Board ("Board"), acting under the
Personal Data Protection Authority, published its principle decision with
number 2018/119 in the Official Gazette, which then corrected on November 7,
2018 ("Decision"). Board's Decision is regarding prevention of promotional
notifications, e-mail messages, text messages and calls that data subjects might
receive from data controllers and data processors.

A. Rationale

In
the beginning of the Decision, the Board indicates that they received numerous
complaints based on the Law No. 6698 on Protection of Personal Data ("Law No.
6698") from individuals, who claim to have received promotional and advertorial
calls, text messages, e-mail messages from parties, whom they did not give consent
for such communications.

The
Board also indicates that, upon receiving such complaints, an investigation has
been conducted on the matter by the Board, results of which were used for
determining the principles set forth in the Decision.

B. Obligations of Data Controllers & Processors

I. Cease of Activity

The
Decision orders data controllers, which direct promotional communications to
data subjects without obtaining data subjects' consents or without meeting the
conditions under Article 5/2 of the Law No. 6698, to immediately cease such
processing activities immediately. Additionally, the Decision also orders data
processors that send such communications on behalf of data controllers, to
cease their data processing activities immediately, as well.

The
Decision lists sending text messages to or calling data subjects phone numbers;
and sending e-mails to data subjects; as methods of communication. Although,
the wording of the Decision appears to be limited to these methods of
communication, considering the purpose of Board's decision, one might argue
that the Board will highly likely apply this principle to every other form of
electronic communication, provided that it is promotional and/or advertorial
and the conditions of the Law No. 6698 are not met.

In
this order, the Board refers to its authority under Article 15/7 of the Law No.
6698, which entitles the Board to decide on cease of data processing or
transfer of data abroad, if there is an obvious violation of laws and there are
irrevocable damages or damages that are hard to recover. In that sense, one
might argue that the Board evaluates such activities as violations of the Law
No. 6698 and is inclined to interpret such activities as damaging to data
subjects, which might be used against data controllers within the scope of
claims by data subjects pertaining to non-pecuniary damages.

II. Precautions

By
referring to Article 12 of the Law No. 6698, the Decision explicitly states that
data controllers are obliged to take all technical and administrative measures
in order to ensure an adequate level of security for the purposes of (i)
preventing unlawful processing of personal data, (ii) preventing unlawful
access to personal data; and (iii) protecting personal data.

Furthermore,
it is also noted in the Decision that if personal data is processed by another
real person or legal entity on behalf of the data controller, the data
controller shall be jointly liable with the data processor for taking the foregoing
measures.

III. Sanctions

The
board states that they will impose the measures provided under Article 18 of
the Law No. 6698 for those who conduct such processing activities, which sets
forth administrative fines for those who fail to comply with certain
obligations under the Law No. 6698.

The
Board also warns that, taking into account the possibility that personal data
process for such activities might be collected unlawfully, they will notify the
relevant public prosecutor's office, so that criminal proceedings could be
initiated for the crime of illegal dissemination and seizure of data in accordance
with Article 136 of the Turkish Criminal Code, under which illegal seizure,
transfer or dissemination of personal data constitutes a crime under and is
subject to an imprisonment up to four years.

Although
the Decision does not explicitly indicates any time period for data controllers
and processors to cease their activities found to be in violation of the Law
No. 6698, it is implied in the Decision that the Board is not eager to punish
on-going activities of data controllers and processor, but merely confines
itself to warn and urge them to cease such activities and act in accordance
with their obligations within the scope of the Law No. 6698.

IV. Checklist for Compliance

Please
find below a short checklist of items that might be considered by data
controllers before sending out promotional communications, for the purposes of
compliance with the Law No. 6698 and Board's principle decision.

1.     
Taken
necessary precautions and measures to protect the contact information which
will be collected from data subjects (such as creating a dedicated storage
space for the relevant data, limiting the number of personnel accessing such
data to senior marketing managers etc.),

2.     
Informed
data subjects about using their contact information for promotional
communications before or, at the latest, during collection of their personal
data and recorded such notice for evidential purposes (be it on paper with data
subject's signature, a voice record or vie electronic logging),

3.     
If
using contact information collected previously for other purposes where data
subject might not be reasonably expected to know that it might be used for such
communications, informed data subject about using their contact information for
this new purpose, before starting processing activities for that purpose; and
recorded such notice for evidential purposes,

4.     
Have
a legal basis for using their contact information for such communications
(please see the table above for the list of valid legal grounds),

5.     
If
not, obtained data subject's explicit consent; and recorded such consent for
evidential purposes.

Please note that data processors should also consider
whether the data controllers, on whose behalf they process personal data and
send promotional communications, are in compliance with the Law No. 6698; and
vice versa, since they are both jointly liable for violations of the Law No.
6698, as explained above.

In any case, it is clear that individuals are starting
to take control of their personal data more and more, as legislations provide
them with new ways to exercise their rights. The Board's decision show that
complaints from individuals impelled the Board to act on its authority and warn
data controllers and processors about the current state of affairs with respect
to their promotional activities.

Authors: Gönenç Gürkaynak Esq., İlay Yılmaz and Türker Doygun,
ELIG Gürkaynak Attorneys-at-Law

(First published
by Mondaq on February 6, 2019)