Along with the progress in information technologies, the fact that even the smallest daily needs are met through electronic commerce has resulted in the advertisement and marketing of goods and services mainly through telecommunication networks. With the effect of the Covid-19 pandemic, the sales of goods and services in electronic environment, which have reached a serious potential in recent years, have also caused an increase in the personal data processing activities of real persons who are the recipients of goods or services.

Service providers who want to communicate with recipients through communication channels such as calls, text messages and e-mails etc. to promote their goods and services; market them, promote their business; or increase their recognition with content such as celebrations and wishes, process personal data (such as name, surname, e-mail, mobile phone, date of birth of the recipients) in this context. Therefore, sending commercial electronic messages and processing of personal data are closely related to each other.

Summarized Evaluation of the Legislation on Commercial Electronic Messages

Commercial electronic messages, which are defined as all kinds of commercial communications made through electronic communication tools in order to promote and market their goods and services in line with the commercial activities of real and legal persons or to increase the recognition of their business, are regulated under the Law No. 6563 on the Regulation of Electronic Commerce ("E-Commerce Law") and the Regulation on Commercial Communication and Commercial Electronic Messages ("Regulation") while the processing of personal data within the scope of sending commercial electronic messages should be considered in terms of personal data processing conditions within the scope of the Personal Data Protection Law No. 6698 ("DPL").

The Regulation brings an obligation to service providers and agent service providers to preserve the personal data obtained due to the transactions and services provided within the framework of the Regulation, without prejudice to the provisions of the relevant legislation, and to take the necessary measures to prevent unlawful access to and unlawful processing of such data. In scope of personal data protection legislation on the other hand, the obligations imposed by the DPL regarding personal data processing activities are rather comprehensive and important.

Within the scope of the DPL, service providers, as data controllers, should receive explicit consent in order to process personal data or they should process personal data within the scope of one or several of the processing conditions listed in the DPL which do not require explicit consent.

According to the Regulation, opt-in is required for commercial electronic messages sent by service providers to the electronic communication addresses of recipients, except for the exceptions specified in the Regulation. The exceptions are (i) commercial electronic messages regarding change, use or maintenance of the goods or services provided if the recipient provides their contact details for the purpose of contacting them; (ii) commercial electronic messages regarding continuing subscription, membership or partnership status and collection; reminder of debt; information update, provided that no goods or services are offered or advertised; messages containing notifications regarding purchase and delivery or similar situations; and the obligation to provide information brought to the service provider by the relevant legislation; (iii) commercial electronic messages sent to the electronic communication addresses of recipients who are craftsman or trader without prejudice to the right to opt-out; and (iv) commercial electronic messages sent to their customers for information purposes by companies engaged in investment activities pursuant to the legislation on capital markets.

In addition, according to the Regulation, service providers are required to notify the Commercial Electronic Message Management System ("IYS") of receipients’ opt-in preferences and contact addresses even though it is not required for them to opt-in. Please click to review our article on the obligation to register to IYS.

Evaluation of Current Personal Data Protection Board Decisions

As mentioned above, sending electronic commercial messages and personal data protection legislation should be considered simultaneously by all service providers. Many issues regarding commercial electronic messages also arise before the Personal Data Protection Board ("Board"). The Board evaluates both legislations and shares its views and directions on the subject with service providers.

In its Principle Resolution dated 16/10/2018 and numbered 2018/119, the Board emphasizes that data controllers who send commercial messages to the phone numbers of the data subjects by sending SMS, making calls or sending e-mail to their e-mail addresses without obtaining the explicit consent of the data subjects or without meeting the processing conditions stipulated in Article 5/2 of the DPL and the data processors who process data without the explicit consent of the data subjects in order to send messages/e-mails or make calls on behalf of the data controllers should immediately cease such data processing activities.

Regarding the personal data processing activities for advertising or commercial purposes as part of sending commercial electronic messages, which data processing condition will be used to process personal data is controversial in practice and in doctrine. In this context, in cases where the receipients opted in within the scope of the E-Commerce Law or in cases where messages are sent without any need for them to opt in within the scope of exceptions, it is argued that the legal reasoning as per Article 5/2 of the DPL for such processing activities should be to establishment, exercise or protection of any right or legitimate interests provided that this processing shall not violate the fundamental rights and freedoms of the relevant data subjects. In this respect, it is stated that an explicit consent is not required within the scope of DPL. A different opinion, on the other hand, agrees that in cases where consent is not required under the E-Commerce Law, there is no need to obtain the explicit consent in scope of the DPL but argues that in cases where consent is obtained, this consent may also mean explicit consent in terms of the DPL. Rather than a strict approach on the issue, in personal data processing activities for advertising and marketing purposes, it is necessary to consider whether there is a reason of lawfulness other than explicit consent in each concrete case. Indeed, it is seen that the Board's approach is in this direction in various Board decisions recently published on the subject matter.

In its recent decisions, the Board refers to the following issues:

• In the processing of the e-mail address by sending unauthorised commercial electronic messages for advertising and marketing purposes by the data controllers; the personal data processing conditions stipulated in Article 5 of the DPL must be fulfilled. Otherwise, it is stated that it will mean that the data controller has not taken the necessary technical and administrative measures to ensure the appropriate level of security in order to prevent unlawful processing of personal data and administrative fines will be imposed. For example, it was rendered for a case where a data controller sent message which should have been sent by the data controller to the customers/members who consented to receive e-mails/SMS on the website to other persons outside of the target receipients, the Board decided that there is no legal reason to send the messages to persons outside of the target receipients and and an administrative fine was imposed on the data controller.
• Privacy notice obligation is stressed in the decisions. Even in cases where a consent is not required, providing an appropriate privacy notice is required in accordance with the DPL.
• In the example of the processing of the data subject's workplace e-mail received from the searches made on internet engines by sending commercial electronic messages by a marketing company without receiving their explicit consent; it was rendered that the personal data processing activity cannot be based on the condition that "the data subject's personal data is publicized by the data subject themself". In parallel with the previous Board decisions on publicisation, the fact that the data subject has made their personal data public does not mean that public data can be used for every processing reason. The reason for which the personal data is made publicly avaliable should also be evaluated.

In the Board decisions referred above, in accordance with the Principle Resolution, it is seen that the Board's approach in personal data processing activities for advertising and marketing purposes within the scope of sending commercial electronic messages is not necessarily based on explicit consent. In the Board's decisions, it is also questioned whether the processing conditions listed in Article 5/2 of the DPL are fulfilled in the data processing activities carried out within this scope. It is observed that the Board has adopted a similar approach in its previous decisions on the same subject.

Summarized Evaluation

Although there is a separate legislation on commercial electronic messages, sending commercial electronic messages to individuals via communication channels such as calls, text messages and e-mails etc. by storing information such as phone numbers and e-mail addresses in a data recording system is a personal data processing activity and the practice of sending commercial electronic messages must also comply with the personal data protection legislation.

Within the scope of sending commercial electronic messages, the service providers shall comply with privacy notice requirements and legal basis within the scope of the DPL should also be identified by the service providers as the data controller. It is not clear whether the consents received within the scope of the E-Commerce Law will constitute explicit consent in the scope of the DPL. The Board has not yet determined an approach which will end the discussions and different practices in doctrine and in practice. However, both opinions in doctrine and in practice conclude that in cases where consent is received within the scope of the E-Commerce Law, there is no need to obtain a separate explicit consent in accordance with the DPL. It is important that this issue be evaluated by the data controllers in each concrete case, and that the privacy notices are prepared in detail to ensure transparency within this context.

Special thanks to Günce Güneş Ceylan for her contributions.