Explicit Consent
As regulated in the Personal Data Protection Law numbered 6698 (the "PDPL"), explicit consent refers to the consent given by data subjects that relates to a specified matter, declared by free will, and based on information. Explicit consent is specified as the general rule under the PDPL. In cases where the data processing activity carried out by the data controller is not considered to be within the scope of any of the legal grounds regulated under the PDPL, the data subject's explicit consent is required to process personal data. However, if the data processing activity is based on one of the legal grounds regulated in the PDPL, other than explicit consent, obtaining explicit consent from the data subject, and basing the data processing activity on explicit consent with the idea of securing such activities, is considered as misleading and as an abuse of right.
The Criteria for Explicit Consent
Three criteria must be met for explicit consent to be considered valid. The first criteria is to obtain explicit consent for a specified matter and limited only to that matter. The data controller must clearly indicate as to which matter it requests the explicit consent. General explicit consent that is not limited to a specific matter is considered to be "blanket consent," and is deemed invalid under the PDPL. Pursuant to the decision of the Personal Data Protection Board (the "Board") dated 27/02/2021 and numbered 2020/173, it has been assessed that the data subject approving all data processing activities that is performed by the data controller with a single consent statement (tracking with cookies, transferring, sharing, storing, etc.) is in violation of the PDPL.
The second criteria for explicit consent to be considered valid is that it be given based on the information provided regarding the data processing activities. This criteria should be considered together with the third criteria, which is explicit consent being expressed with free will. For the data subject to freely demonstrate explicit consent, he/she must know what kind of data processing he/she consents to, as well as the consequences of said consent. For this reason, it is important that the privacy notice to be submitted to the data subject covers all issues related to the data processing activities in a clear and understandable manner, in accordance with the PDPL and the Communiqué on Principles and Procedures to be Followed in Fulfilment of the Obligation to Inform.
The third criteria for giving explicit consent is based on free will. The explicit consent given by the data subject must not be defective. It is not possible to speak of the free will of an employee candidate if he/she gives explicit consent with the thought that the job application will not be evaluated if he/she does not give explicit consent for the processing of his/her personal data, other than those required for that position. The same applies in the case of a potential customer giving explicit consent with the purpose of benefiting from a service, with the thought that the service will not be provided if explicit consent is not given.
Explicit Consent Cannot Be Presented as a Precondition for the Provision of Services
In cases where it is legally required to process personal data (eg. health data) for the provision of a service and said personal data may only be processed based on explicit consent, requesting explicit consent is not considered as a precondition for the provision of services. Thus, pursuant to the Board decision dated 03/09/2020 and numbered 2020/667, if processing of health data is outside the scope of the legal grounds stipulated under the PDPL for the processing of special categories of personal data, and this data may only be processed upon the explicit consent given by the data subject, requesting explicit consent will not be considered as a precondition for the provision of services. However, if explicit consent is not required for the service to be offered but if, for example, the service provider requests explicit consent from the data subject who wishes to benefit from the service in relation to its subsidiary activities (e.g. marketing), and it is understood that such data subject cannot benefit from the service if he/she does not give explicit consent relating to such data processing activity, it is possible to say that this is in violation of the PDPL, as the service is subject to the precondition of explicit consent.
Making any matter conditional on the explicit consent of the data subject, including providing services to the data subject, will invalidate the explicit consent. Pursuant to the Board's decision dated 08/07/2019 and numbered 2019/206, and the Board's decision dated 20/04/2021 and numbered 2021/389, offering a product or service to the data subject, or enabling the data subject to benefit from a product or service on the condition that explicit consent must be given, is contrary to the rule of expressing consent with free will and, thus, such consent is invalid. In short, if the data controller imposes explicit consent on the data subject as a precondition of the service and, thereby, the contract, the explicit consent will be deemed as defective. Although this rule was established in Board decisions, it was not explicitly regulated within the scope of the legislation. However, pursuant to the Regulation on Sharing Confidential Information published this month, it is determined that bank customers' explicit consent regarding the sharing of their information cannot be determined as a precondition for the bank to provide its services; thus, including the rule in the legislation in relation to bank customer's personal data, is in line with the Board decisions. With the inclusion of the relevant rule in the legislation, it is possible to say that data controllers, which are service providers, especially banks, will approach this issue more diligently, and refrain from practices that base the services to be provided on the condition of explicit consent.
Originally published 21.06.2021
© Kolcuoğlu Demirkan Koçaklı Attorneys at Law 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
