May ’23

In its decision published on 24 April 2023, the DPA emphasised the importance of fundamental principles of explicit consent, particularly based on information and free will. In addition, the DPA issued its findings on the sharing of customer data with relevant institutions in the banking sector. With this decision, the data controller bank, which failed to (i) transfer customer data based on a valid legal basis and (ii) obtain explicit consent based on information and free will, has been subject to an administrative fine of TRY 250,000 (approx. EUR 11,200).

Background:

The data subject, which repeatedly received contact from an insurance company on their personal phone, discovered that the data controller bank had shared their phone number with the insurance company. Consequently, the data subject lodged a complaint with the DPA.

Considerations by the DPA:

The DPA evaluated a document entitled “Campaign Communication Preferences Instruction” through which the data subject granted authorisation for receiving messages. Upon examining the instruction, several issues were identified:

1. ambiguous expressions were used concerning future actions,
2. consent boxes were pre-selected by default, and
3. the data subject was not adequately informed about the transfer of their personal data.

As a result, the DPA determined that these practices contradict the fundamental principles of explicit consent, specifically the principles of being “based on information” and “based on free will”.

Despite the data controller bank asserting that (i) under Turkish banking law, it had the authority to share specific limited data with the institutions it collaborates with for services and support, and (ii) the data subject had given consent to receive commercial messages, these claims were rejected. The DPA concluded that the data controller had no valid legal basis to transfer the data subject’s contact data to the insurance company, since there was no exemption from the confidentiality obligation under Turkish banking legislation, and explicit consent for such transfer was not obtained in line with the DP Law.

What is the Decision?

As a result, the DPA imposed an administrative fine of TRY 250,000 (approx. EUR 11,200) on the data controller due to (i) lack of a valid legal basis for the data transfer and (ii) failure to implement adequate technical and organisational measures when transferring the data subject’s contact data to a third party.