Turkish Personal Data Protection Board addresses using personal data from third parties for advertising and marketing purposes

The Announcement by the Turkish Personal Data Board (Board) was issued after receiving complaints that data controllers had been contacting data subjects using telephone numbers, e-mail addresses and other contact information obtained from existing customers or other third parties. According to the Board, such data is frequently collected through referral programmes, customer recommendations, acquaintance referrals, brand ambassador initiatives and similar marketing arrangements.

The Board notes that its investigations identified instances when personal data obtained from third parties was used for advertising and marketing activities without the consent of the affected data subjects and, in certain cases, without a valid legal basis for processing. The Board reminds data controllers that receiving personal data from a third party does not meant the data can be used for marketing purposes.

The purpose of the Announcement is to raise awareness on the obligations of data controllers when using third-party sourced personal data and to prevent potential infringements of the rights of data subjects under the Law No. 6698 on the Protection of Personal Data (KVKK). 

Scope of the Announcement

The Announcement is focused on data controllers that obtain contact details from data subjects other than the data subject and use such information for advertising or marketing communications.

Core obligations

Third-Party sourcing does not constitute a legal basis

The Board expressly states that obtaining personal data from a third party does not provide a lawful basis for processing such data for advertising and marketing purposes.

Pursuant to Article 5 of the KVKK, personal data may not be processed without the data subject’s explicit consent. Where explicit consent is not obtained, the processing activity must be based on one of the statutory legal grounds set out in Article 5, such as where processing is expressly permitted by law, necessary to protect life or physical integrity, necessary for the performance of a contract, required for compliance with a legal obligation, relates to data made public by the data subject, is necessary for the establishment, exercise or protection of a legal right, or is necessary for the legitimate interests of the data controller provided that the data subject’s fundamental rights and liberties are not adversely affected.

The Board emphasises that obtaining personal data from a referral source, existing customer or any other third party does not satisfy the requirements of Article 5. Hence, the availability of a lawful basis must be assessed on a case-by-case basis.

Obligation to inform must be fulfilled

The Announcement reiterates the obligation under Article 10 of the KVKK to inform data subjects of the following when their personal data has been obtained:

• the identity of the data controller;
• the purposes of processing;
• the recipients and purposes of any data transfers;
• the method and legal basis for collecting personal data; and
• the rights available to data subjects under Article 11 of the KVKK including the right to obtain information regarding the processing of their personal data, to request the correction or deletion of personal data where applicable, to object to certain processing activities and to seek compensation for damages arising from unlawful processing.

Requirements where data is not collected directly from the data subject

Article 10 sets the general rule on timing. Where personal data is not obtained directly from the data subject, the timing of reporting any data processing is governed by Article 6 of the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform (Communiqué). According to the Board, where personal data cannot be obtained directly from the data subject due to factual impossibility or because the data subject cannot be reached, data controllers must inform data subjects according to the follow time frames:

• within a reasonable period following collection of the personal data;
• at the time of the first communication with the data subject where the data is used for contact purposes; or
• at the latest upon the first transfer of the personal data.

The Announcement highlights that data subjects are frequently contacted by call centres for direct marketing purposes without first being properly informed.

Silence, inaction and continued engagement do not constitute consent

The Board notes that certain organisations appear to interpret the following as evidence of consent:

• continuing to listen to a marketing call;
• not terminating a conversation immediately;
• asking questions regarding the data controller’s activities; or
• failing to send an opt-out response to an SMS message.

The Board expressly rejects this approach and confirms that this conduct cannot be considered valid explicit consent under the KVKK. 

Valid and explicit consent must:

• relate to a specific matter;
• be based on information; and
• be given through the data subject’s free will.

The Board states these elements must be present for consent to be considered explicit under the KVKK.

Privacy notices and consent collection must be kept separate

The Announcement states that for a data subject to have a sufficient understanding of the personal data to be processed and its consequences, the information provided must be clear, comprehensible and free from ambiguity. Once the information process has been completed, the data subject’s explicit consent must be obtained separately for any personal data processing that relies on explicit consent as the legal basis.

In line with Article 5 of the Communiqué, the Board further reiterates that fulfilling the obligation to inform and obtaining explicit consent are separate legal processes. Data controllers must first fulfil their obligation to inform. Only then can they obtain explicit consent when required as the relevant legal basis.

Compliance expectations highlighted by the board

At the conclusion of the Announcement, the Board outlines compliance measures that data controllers should implement when carrying out marketing activities involving personal data obtained from third parties. In particular, the Board emphasises that:

• where personal data cannot be obtained directly from the data subject, the information obligation must be fulfilled in a timely manner according to Article 6 of the Communiqué;
• data subjects must be provided with clear, comprehensible and complete information regarding the processing of their personal data;
• where processing is based on explicit consent, this consent must relate to a specific matter, be based on information and be freely given;
• a data subject’s passive conduct, such as continuing to listen to a promotional call, choosing not to terminate a conversation, requesting information or failing to opt out of an SMS message, should not be regarded as valid explicit consent;
• the fulfilment of the obligation to inform and the collection of explicit consent must be conducted as independent processes; and
• all personal data processing activities carried out within the scope of advertising and marketing must comply with the KVKK and applicable secondary legislation while respecting the fundamental rights and liberties of data subjects.

Importantly, non-compliance with the KVKK may trigger administrative sanctions under Article 18. Given the Announcement’s emphasis on obligation to inform, data controllers should pay particular attention to compliance with the information obligation under Article 10 since failure to comply can result in administrative fines. 

Conclusion

The Announcement does not introduce new legal requirements but provides important clarification regarding the Board’s expectations about referral-based marketing and other activities involving personal data obtained from third parties. In particular, the Board reaffirms that obtaining personal data from a third party does not alone create a lawful basis for processing and that passive behaviour cannot be relied upon as valid explicit consent.

Businesses that rely on customer referrals, recommendation programmes, brand ambassador initiatives, lead-generation arrangements or similar marketing models should review their data processing and consent practices to ensure full compliance with the KVKK.

For more information on the Announcement, contact the experts who contributed to this article: [email protected] , [email protected] , and [email protected].