Decision of the Personal Data Protection Board
The Personal Data Protection Board (“Board”) published a decision regarding sending an SMS by an association without obtaining explicit consent of a data subject.
Data subject complained to the Board that an advertising SMS was sent by an association without obtaining a prior explicit consent of himself, and although, data subject requested information from the association regarding advertising SMS, the association had failed to respond within the legal period of 30 days.
The association stated that the data subject’s request to obtain information was unanswered due to organizational reasons and data subject’s phone number was immediately removed from its SMS list. The association added that only personal data that had been processed was the data subject’s phone number, which was acquired when the data subject made a donation by sending a text message.
The Board ruled that processing personal data without obtaining data subject’s prior consent (i.e., sending an SMS to data subject’s phone number) is a violation of the Law No. 6698 on the Protection of Personal Data (“Law”) and thus, it is a clear indication that the obligations related to data security under the Law have not been orderly fulfilled by the association. The Board accepted that the association’s failure to respond to the request of the data subject as a violation of the obligations of the data controller arising from the Law and instructed the association to be more careful and attentive to not to send an SMS without the explicit consent of data subjects. Additionally, the Board stated that the phone number which was recorded without an explicit consent must be immediately destroyed.
Consequently, the Board decided to impose an administrative fine on the grounds that the association had not implemented any of legally required technical and administrative measures.
You may find the full Turkish text of the decision here.
