Turkish Personal Data Protection Authority Publishes Public Announcement on the Use of Personal Data Obtained from Third Parties for Advertising and Marketing Purposes

The Announcement has been issued to inform the public about the obligations of data controllers under the Personal Data Protection Law No. 6698 (the "Law") in relation to such processing activities.

Key Points Highlighted in the Notice

The Authority emphasized that the mere fact that personal data has been obtained from third parties does not constitute a sufficient legal basis for processing such data for advertising and marketing purposes. Through this Announcement, the Authority once again reminded data controllers of their obligations under the Law. In this context, the following key points were highlighted:

• As a rule, personal data cannot be processed without the explicit consent of the data subject. However, where one of the legal grounds for processing set out under Article 5 of the Law exists, personal data may be processed without obtaining explicit consent. Whether an appropriate legal basis exists for advertising and marketing activities must be assessed separately on a case-by-case basis.


• The Authority referred to the provisions of the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform regarding situations where personal data is not obtained directly from the data subject. Accordingly, where personal data cannot be obtained directly from the data subject due to factual impossibility or because the data subject cannot be reached, data controllers are required to inform the data subject: (i) within a reasonable period following the collection of the personal data; (ii) at the time of the first communication, where the personal data will be used to communicate with the data subject; or (iii) at the latest, at the time of the first transfer, where the personal data will be transferred to a third party.


• Explicit consent must be a declaration of will relating to a specific subject matter, based on adequate information and expressed through the data subject's free will. Accordingly, implied actions—such as continuing to listen to a promotional call, not ending the call, requesting further information, or failing to send an opt-out response to an SMS—do not constitute valid explicit consent.


• Data subjects must be informed about the processing of their personal data in a clear, comprehensible and complete manner, in compliance with the Law.


• The obligation to inform and the process of obtaining explicit consent must be carried out independently from one another. Accordingly, the data controller must first duly fulfil its obligation to inform the data subject. Where explicit consent is required, such consent must subsequently be obtained through a separate declaration of intent reflecting the free will of the data subject.

Conclusion

Through this Announcement, the Authority has reaffirmed that all personal data processing activities carried out within the scope of advertising and marketing must comply with the provisions of the Law and the applicable secondary legislation, while respecting the fundamental rights and freedoms of data subjects. The Authority also reminded data controllers that administrative sanctions may be imposed pursuant to Article 18 of the Law in the event of non-compliance.

Accordingly, businesses conducting marketing activities through telephone calls or SMS messages on the basis that the relevant individuals' contact details have been obtained from third parties through referrals, recommendations, personal introductions or customer referrals should review their personal data processing practices in accordance with the principles set out in the Announcement.

The Announcement is available here.


Aslı Kınsız, Managing Associate
Sevim Özkan, Associate