KVKK issues SMS warning to stores: Information must be provided, explicit consent must be obtained

Recently, it has been noted that during checkout processes in stores, customers are sent an SMS verification code under the pretext of completing payment and generating an invoice, but are subsequently sent promotional SMS messages by the store. The Personal Data Protection Authority (KVKK) has issued a second warning to stores regarding this practice, which has drawn public criticism.

Personal data is no longer personal. Our information is either obtained through the hacking of systems belonging to institutions where we are registered, or we provide it to stores voluntarily while shopping. Recently, the practice of stores requesting phone numbers during payment for the purpose of sending an SMS verification code and generating an invoice, followed by the arrival of promotional messages and announcements from these stores, has sparked backlash. The Personal Data Protection Authority (KVKK) highlighted this situation in a statement on its website.

The statement from the KVKK recalled that a public announcement had been issued previously due to complaints regarding the same issue. Noting that the current practice continues, the statement said, "it has become necessary to update the public announcement."

The statement, which emphasizes that stores must inform consumers and obtain their explicit consent, is as follows:

The conditions for processing personal data are regulated in Article 5 of the Personal Data Protection Law (Law) No. 6698. Accordingly, after it is stipulated in paragraph (1) of Article 5 of the Law that personal data cannot be processed without the explicit consent of the data subject, paragraph (2) lists the processing conditions under which it is possible to process personal data without the explicit consent of the data subject.

In Article 3 of the Law, explicit consent is defined as "consent related to a specific subject, based on information, and expressed with free will," and it is seen from this definition that there are three elements that explicit consent must possess. First, the explicit consent obtained must be related to a specific subject and limited to that subject; in other words, the data controller must clearly state the subject for which the declaration of explicit consent is requested. If a declaration of explicit consent is to be made for the processing of data related to multiple categories, it is mandatory for the explicit consent to cover different aspects of the processing, such as which data will be processed and for what purposes. Explicit consent is a declaration of will, and for a person to be able to consent freely, they must also know what they are consenting to; in this sense, the person must have full knowledge not only of the subject but also of the consequences of their consent. Finally, explicit consent, which is a declaration of will, will only gain validity if the person is conscious of their actions and it is their own decision. Any situation that impairs a person's will, such as duress, threat, error, or fraud, will also impair the explicit consent given for the processing of personal data, and in such cases, it will not be possible to speak of a free declaration of will. Furthermore, if obtaining the explicit consent of the data subject is presented as a prerequisite for the provision of a product or service or for benefiting from a product or service, a valid explicit consent cannot be mentioned as the element of free will is compromised.

On the other hand, pursuant to Article 10 of the Law, during the collection of personal data, the data controller or the person authorized by them must fulfill the obligation to inform by providing information to the data subjects regarding the identity of the data controller and their representative if any, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis for collecting personal data, and other rights listed in Article 11 of the Law. In this context, the obligation to inform is an obligation that must be fulfilled independently of both obtaining explicit consent and ensuring other personal data processing conditions in the Law. However, in cases where the personal data processing activity is carried out based on the explicit consent of the data subject, the data controller must fulfill the obligation to inform and the process of obtaining explicit consent separately.

In this context, as a result of the evaluations made by the Personal Data Protection Authority;

• It is important that the purpose of the SMS to be sent to individuals' phones during checkout processes following a purchase in a store, and the consequences of providing the code transmitted via this SMS, be conveyed to the data subjects in a clear and understandable manner by the persons authorized by the data controller in the stores at the first stage as a requirement of layered information, and that necessary information channels be provided in the content of said SMS in order to fulfill the obligation to inform,
• Practices aimed at performing different processing activities—such as approving a membership agreement, obtaining permission to process personal data, obtaining consent for commercial electronic messages, etc.—with a single action by sending a verification code via SMS to data subjects during payment transactions in stores should be terminated; explicit consent should be obtained separately by offering options for processing activities that must be carried out with explicit consent,
• In addition to this, the processes of obtaining explicit consent and fulfilling the obligation to inform by data controllers should be carried out separately,
• In the event that an application is made to send an SMS verification code to obtain explicit consent for the sending of commercial electronic messages, the explicit consent to be obtained in said transaction must cover all elements specified in the Law,
• Giving explicit consent for the processing of personal data for the purpose of sending commercial messages should not be presented to data subjects as a mandatory element for the completion of the purchase; otherwise, as such an application may cause damage to the elements of "being based on information and expressed with free will," which are among the elements of explicit consent, such applications must be carried out in accordance with the Law,
• In this context, explicit consent for the processing of personal data for the purpose of sending commercial electronic messages should be requested after the completion of the purchase; thus, preventing the explicit consent for commercial electronic message permission from being perceived as a necessary element of the purchase

is of importance. Respectfully announced to the public.

It is observed that allegations are included stating that said code is requested to be reported to the cashier on the grounds that it is necessary for the completion of payments, invoice generation, forwarding the invoice to the contact address, or updating information, but following the transaction in question, commercial electronic messages related to the store's activities are sent to the relevant individuals.

News Source: 12punto