The Personal Data Protection Authority (KVKK) has decided to impose an administrative fine of 200,000 lira on a clothing store because a customer's personal data on its website became accessible to third parties.
The incident in question came to light when a customer received a message regarding an order from the online clothing store they were a member of, which they stated they had not placed. Upon logging into their account, the customer realized that another person had performed transactions using their membership, changed their address information, and created an order.
The customer filed a complaint with the KVKK on the grounds that their personal data had been made accessible to third parties. As a result of the investigation, it was determined that the complainant's name, surname, membership information, and telephone number data were shared on the data controller's website in a way that was widely accessible.
The KVKK concluded that the clothing store had failed to take the necessary technical and administrative measures to prevent the unlawful processing of personal data. In its decision, the Board stated that making customer information accessible to third parties was not based on any of the personal data processing conditions stipulated in the Personal Data Protection Law No. 6698.
News Source: 12punto
