The regulation of unsolicited commercial communications

1. How does national law regulate the making of unsolicited telephone calls for marketing purposes?

Electronic commercial communications are regulated by the Law on the Regulation of Electronic Commerce numbered 6563 (E-Commerce Law), which came into force on 1 May 2015, along with the Regulation on Commercial Communication and Electronic Commercial Messages (Commercial Communication Regulation). The E-Commerce Law defines electronic commercial communications as messages with commercial purposes sent via telephone calls, call-centres, fax, auto diallers, smart voice recorders, email or SMS. The law covers natural or legal person service providers and intermediary service providers that send those messages while performing electronic commercial activities.

Accordingly, service providers sending electronic commercial messages must obtain the recipient’s prior consent, unless:

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

  • The recipient had voluntarily provided its details to the service provider, and the message relates to the change, use and maintenance of the goods or services already obtained.
  • The electronic message relates to the collection of debt, payment reminders, update of information, purchases, delivery or similar actions with regard to an ongoing subscription, membership or partnership, but does not promote other goods or services.
  • The recipient is a merchant or a craftsman.
  • The message serves as an information message sent to customers by a company that conducts intermediary activities regulated by the capital market legislation.

In other words, the relevant legislation provides an opt-in system solely for individuals who want to receive electronic messages for promotional purposes.

On the other hand, the service providers are under an obligation to offer appropriate opt-out mechanisms to both individuals and merchants or craftsmen. Recipients may exercise their right to refuse receiving commercial electronic messages at any time, without specifying any reason (Article 8/1, E-Commerce Law). Service providers must inform their recipients of their right to opt-out and include easy and free means of opting out via text, URL and so on in every commercial electronic message sent by them. Once the service provider receives an opt-out request, it must stop sending commercial electronic messages to the recipient within three business days.

A recipient’s consent, which must include their acceptance to receive electronic commercial messages, can be obtained in writing or via any channel of electronic communication (Article 6/1, E-Commerce Law). Electronic messages sent to obtain consent are not allowed to include commercial or promotional content. Related consent forms must be provided in such a way that the affirmative declaration of intent is not selected by default, and that the recipient’s consent is not a prerequisite to acquire goods or services.

The content of an electronic commercial message must be in accordance with the consent obtained from the recipient (Article 7/1, E-Commerce Law). Depending on the medium, electronic commercial communications must include at least one of: phone number, fax number, SMS number or email address of the service provider.

Unless it is clearly understood from the message’s content, electronic commercial messages must include a statement indicating that the message is of a promotional or commercial nature. For voice calls, this statement must be conveyed at the beginning of the conversation.

Service providers may send electronic commercial messages to the consenting recipients via their intermediary service providers, which are defined as natural or legal persons providing electronic commercial platforms for the economic and commercial activities of the service providers. The electronic commercial messages sent by these intermediary service providers should include at least one of the following: their brand name, trade name or enterprise name. Intermediary service providers are not held responsible for monitoring the content provided by the users of the electronic platform.

Natural or legal person recipients are entitled to file complaints against unsolicited or noncompliant commercial messages within three months of receiving them (Article 14/3, Commercial Communication Regulation). Complaints can either be submitted online through the E-Government gateway and the website of the Trade Ministry, or filed in writing before the provincial directorate at the complainant’s place of residence. If the electronic commercial communication was conducted via phone call, the recipient should include in its formal complaint its TR identity number, telephone number, name of the GSM/landline operator, phone number or brand/enterprise name of the sender, and date and content of the message. If the recipient or complainant is a merchant, the complaint

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

should also include the merchant’s Central Registration System Number (MERSIS number); craftsmen should indicate that they are craftsmen (Article 14/2(c), Commercial Communication Regulation).

Electronic commercial communications sent by licensed operators in the electronic communication sector are not covered by the Commercial Communication Regulation, but instead by the Electronic Communications Law numbered 5809 (E-Communication Law). Operators are not allowed to send unsolicited communication for the purposes of direct marketing, political propaganda or transmission messages with a sexual content via auto dialers, fax, emails or short messages without the prior consent of their subscribers or other consumers (Article 50/5, Electronic Communications Law).

Article 50/6 of the Electronic Communications Law is also similar to the Commercial Communication Regulation, as it allows operators to convey communications relating to the promotion, marketing, alteration and maintenance of the goods or services already obtained by their customers, or goods or services similar to them, The contact details of the customers must have been acquired during the provision of a good or service, and the customers must have been informed of the possibility of future communication, as well as their right to opt out.

Operators should provide to their customers and other consumers easy and free means of opting out (Article 50/7, E-Communication Law). Unlike the E-Commerce Law, which is implemented by the Ministry of Trade, the E- Communications Law is implemented by the Information and Communication Technologies Authority (BTK).

2.How does national law regulate direct marketing by fax?

See Question 1.

3. How does national law regulate direct mail advertising?

There is no explicit mention of direct mail advertising in the legislation discussed at Question 1. However, provisions of data protection legislation may apply to direct mail advertising which targets specific individuals.

The Law on The Protection of Personal Data n. 6698 (Data Protection Law) grants protection to natural persons’ personal data, which are defined as any information relating to an identified or identifiable natural person. Personal data cannot be processed without the explicit consent of the data subject (Article 5/1, Data Protection Law). The definition of processing includes the collection and recording of personal data. Processing personal data without the explicit consent of the data subject is only allowed if:

  • It is clearly provided for by the law.

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

  • It is necessary for the protection of life or physical integrity of a person, or of any other person who is bodily incapable of giving their consent or whose consent is not deemed legally valid.
  • Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the conclusion or fulfilment of that contract.
  • It is necessary for the controller to be able to perform its legal obligations.
  • The data had been made available to the public by the data subject.
  • Data processing is necessary for the creation, exercise or protection of any right.
  • It is necessary to protect the legitimate interests of the controller, provided that the processing will not breach the fundamental rights and freedoms of the data subject.

(Article 5/2, Data Protection Law.)

Data controllers may be held responsible for collecting and using the mail addresses of individuals for advertising purposes unless they obtain the explicit consent of the data subject in accordance with the Data Protection Law, or unless one of the limited exceptions provided above applies to the situation.

It should also be noted that individuals whose address is being used in this manner are afforded various rights by virtue of Article 11 of the Data Protection Law. These include the right to learn from the data controller whether their personal data are being processed or transferred, and the right to request the erasure, destruction or anonymisation of their personal data once the purposes for processing the data cease to exist.

Data subjects can exercise their rights by lodging an application in writing to the controller. Controllers must resolve these applications promptly, or at the latest within 30 days of submission.

The resolution should be provided free of charge by the data controller, unless the relevant action incurs a supplementary cost, which may be collected at the price set by the Personal Data Protection Board (Article 13, Data Protection Law). If the application is declined, or if the resolution is not satisfactory or given in due time, the data subject may file a formal complaint with the Personal Data Protection Board within 30 days of being given the resolution, and in any case within 60 days as of the application date (Article 13, Data Protection Law).

4. How does national law regulate direct marketing by email?

See Question 1, which explains the law as it pertains to all electronic communications.

For emails, the statement indicating that the message is of a promotional or commercial nature must be conveyed in the subject area of the email.

If the recipient of an unsolicited or non-compliant commercial message sent via email files a complaint against it, the complaint should include the recipient’s TR identity number, email address, name of the email service provider, email address of the sender and the date and content of the message. A copy of the email should also be included.

5. How does national law regulate direct marketing by text messaging (SMS)?

See Question 1, which explains the law as it pertains to all electronic communications.

Commercial electronic communications via SMS that are sent by merchant service providers should include their MERSIS number. An SMS sent by craftsmen service providers should include their name, last name and Turkish ID number.

In an SMS, the expression indicating that the message is of a promotional or commercial nature must be conveyed at the beginning of the text message.

If the recipient of an unsolicited or noncompliant commercial message sent by SMS files a complaint against it, the complaint should include the recipient’s TR identity number, phone number, name of the GSM operator, number or the brand or enterprise name of the sender, the date of the message, and the entire contents of the SMS. If possible, a copy of the SMS should also be included.

6. How do your national data protection regulations impact on direct marketing campaigns?

Service providers are responsible for the preservation and protection of personal data and cannot disclose the same to third parties, or use the data for other purposes, without the consent of the data subject (Article 10, E-Commerce Law).

In addition the decision of the Personal Data Protection Authority (KVKK) dated 16 October 2018 n. 2018/119 states that:

  • Data controllers that send electronic advertising messages via SMS, phone calls or emails without obtaining the consent of the data subject or without fulfilling one of the exceptions under Article 5/2 of the Data Protection Law (please refer to Question 3 for exceptions to obtaining explicit consent), as well as data processors that use such data without the explicit consent of the relevant data subjects for the purpose

of sending electronic advertising messages on behalf of the data controllers, must immediately cease those processing activities following a decision of the Personal Data Protection Board (Article 15/7, Data Protection Law).

  • Data controllers must take necessary technical and administrative measures to prevent the unlawful processing of, and unauthorised access to, personal data, and to ensure protection of personal data with a sufficient level of security (Article 12, Data Protection Law). The data controller will be held jointly

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

responsible with any legal or natural person third party data processor acting on its behalf with respect to taking these precautions.

  • Data controllers who are in breach of the above rules will be liable to the following administrative fines:
    • failure to comply with the obligation to inform data subjects during collection of personal data is punishable by an administrative fine of TRY5,000 to 100,000;
    • failure to comply with the obligations related to data security (Article 12, Data Protection Law) and to taking necessary measures is punishable by an administrative fine of TRY15,000 to TRY1 million;
    • failure to comply with the decisions issued by the Personal Data Protection Board under Article 15 of the Data Protection Law is punishable by an administrative fine of TRY25,000 to TRY1 million; and
    • failure to meet the obligations to enrol in the Registry of Data Controllers and make a notification as provided for in Article 16 of the Data Protection Law is punishable by an administrative fine of TRY20,000 to TRY1 million.

(Article 18, Data Protection Law.)

  • Since it is possible that the above personal data was collected through unlawful methods by the data controller, the matter must be reported to the Chief Public Prosecutor’s Office for the opening of the necessary proceedings in accordance with Article 136 of the Turkish Criminal Code No. 5237, titled “Unlawful Delivery and Acquisition of Data” (Article 158, Code of Criminal Procedure).

This decision has reinforced the consensus that targeted advertisements via electronic commercial messages are also subject to the Data Protection Law. On the other hand, some practitioners argue that the same decision should not be apply to untargeted advertisement messages, and that in these cases the E-Commerce Law alone should apply instead.

Although the full implications of this decision are still being debated by legal scholars in Turkey, it is generally advisable for data controllers engaging in direct electronic communications to obtain two separate expressions of consent from their data subjects: one to send electronic commercial messages and another to process the personal data of the individual.

7. What sanctions exist for breach of unsolicited marketing communications legislation?

Service providers that breach their obligations under the E-Commerce Law can be punished by administrative fines imposed by the Ministry of Trade or its related general directorate (Article 12, E-Commerce Law). The specific fines are as follows:

  • Failure to comply with consent obligations provided under Article 6/1 and Article 7/1 of the E-Commerce Law is punishable by an administrative fine of TRY1,000 to 5,000.

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

  • Failure to provide sufficient contact information as per Article 7/2 E-Commerce Law or other information clearly identifying the natural or legal person sending the commercial communication within the relevant message is punishable by an administrative fine of TRY1,000 to 10,000.
  • Failure to provide sufficient and clear information on promotions such as discounts, gifts and contests designed to identify their features and the terms of participation, failure to provide easy and free means of opting out, and failure to cease the commercial electronic messages in three business days following the recipient’s opt-out request is punishable by an administrative fine of TRY2,000 to 15,000.
  • Failure to provide documents or information on request of the Ministry of Trade is punishable by an administrative fine of TRY2,000 to 5,000.
  • Failure to log information requested by the Ministry of Trade in the electronic system created by the Ministry of Trade is punishable by an administrative fine of TRY5,000 to 20,000.

(Article 12/1, E-Commerce Law.)

If a service provider sends an electronic commercial message in breach of Article 6/1 of the E-Commerce Law to multiple persons, the service provider is liable to a fine ten times the applicable administrative fine (that is, TRY1,000 to 5,000) (Article 12/2, E-Commerce Law).

The relationship between the E-Commerce Law and the Data Protection Law as regards electronic commercial messages is still debated due to the KVKK decision dated October 16, 2018 n. 2018/119 (see Question 6). It is argued that, if an electronic commercial message is in breach of both these laws, the rules on joinder of misdemeanours should apply and the highest of the respective administrative fines should be imposed (Article 15, Law on Misdemeanours numbered 5326).

If the personal data was collected, transferred or processed through unlawful methods by the data controller to send the direct commercial communication, or if the data controller fails to destroy personal data, the following provisions of the Turkish Criminal Code may apply:

  • Unlawful recording of personal data is punishable by imprisonment of one to three years (Article 135, Turkish Criminal Code).
  • Unlawful transfer or collection of data is punishable by imprisonment of two to four years (Article 136, Turkish Criminal Code).
  • Failure to destroy data following the expiration of the legally prescribed period is punishable by imprisonment of one to two years (Article 138, Turkish Criminal Code).

It should be noted that these criminal sentences are valid for natural persons; the Criminal Code only allows for relevant security measures to be imposed on legal entities.

8. Please list additional national rules that may apply to direct marketing campaigns. Please explain why they apply and provide references.

The general principles of advertising which are stipulated by the Law on the Protection of the Consumer No 6502 (Consumer Law) and the Regulation on Commercial Advertisements and Unfair Practices No 29232 (Advertising Regulation) would apply to the content of direct marketing campaigns and communications.

The Advertising Regulation defines commercial advertisements as “announcements published by advertisers in all and any channels, aiming to promote the sale or rent of goods or services, and to inform or convince the target audience (identified by trade, type of business, craftsmanship or occupation), by means of commercial communication carried out in written, visual, auditory and other similar media”. Therefore, every kind of commercial communication, including direct marketing messages, would be regarded as an advertisement.

The communications should be in conformity with the laws, the principles adopted by the Board of Advertisement, general morality, public order and personal rights, and they should also be accurate and correct (Article 61, Consumer Law).

Advertisements should not deceive or mislead the consumer, abuse their lack of experience or knowledge, threaten the life of the consumers or the safety of their property, encourage acts of violence or incite committing crime, endanger public health, or abuse the elderly, children or disabled people. Implicit or hidden advertising, (defined as the inclusion of commercial and promotional content in a commercial communication without explicitly indicating that such inclusion and presentation is for advertising purposes) is strictly forbidden.

Advertisements relying on claims supported by statements of natural or legal persons (testimonial advertisements) should not include testimonial statements that are not based on the experience, knowledge or research results of those persons, institutions or organisations. The statements should be true and actual.

According to the Advertising Regulation, comparative advertisements are allowed only if they contain comparisons between competitors’ products or services which are used for the same purposes and to address the same needs. The use of product names, trade marks, logos, trade names, business names and other distinctive elements belonging to one’s competitors in comparative advertisements is prohibited (Article 8/1, Advertising Regulation).

Direct selling and teleshopping advertisements which suggest sales transactions to be conducted at the address of the viewer must clearly and accurately define the advertised product or service, together with its price (Article 27, Advertising Regulation). A clear return policy should be offered to the target audience of these advertisements, together with contact information of the advertiser, so that the consumer knows that they have a right of withdrawal with respect to the purchased product or service. The sales price of the product or service and the withdrawal right of the consumer should be clearly mentioned in the advertisement.

It is possible for natural or legal persons to complain against commercial communications electronically or in writing (Article 8, Advertising Board Regulation). Natural person applicants should include their names, last names, TR identity numbers and addresses in their application.

Legal person applicants must include their trade names and addresses. The application should also include information concerning the medium where the advertising was displayed, the date of the advertisement and the subject of the complaint. If the advertisement is in writing or on printed media the originals should also be provided. Otherwise, copies of the commercial communications’ images would suffice.

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

Advertisers, advertising agencies and media providers that breach their obligations under Article 61 of the Consumer Law can be punished by being suspended from broadcasting and/or administrative fines as imposed by the Board of Advertisement (Article 77/12, Consumer Law):

  • For breaches committed via the internet, an administrative fine of TRY85,480 shall be imposed.
  • For breaches committed via SMS, an administrative fine of TRY42,738 shall be imposed.
  • For breaches committed through other means, an administrative fine of TRY8,546 shall be imposed.

If the breach that was subject to administrative action is repeated within the same year, the Board of Advertisement may impose administrative fines up to ten times the levels set out above.

Cross-border communications

9. Under the laws of your country, is a direct marketer bound by the laws of the country of the recipient of unsolicited commercial communication (EU principle of the country of destination)?

There is no rule under domestic law that binds direct advertisers by the laws of the country of the recipient.

10. Under the laws of your country, can an individual seek redress in their own courts against a foreign company who targeted them in breach of that individual’s laws against unsolicited communications?

The E-Commerce Law, Consumer Law and Data Protection Law all apply to foreign companies conducting business and sending electronic commercial messages in Turkey. Therefore, the same administrative sanctions would apply to foreign companies as to domestic companies.

Self-regulation

11. Through which organisations is direct marketing self-regulated in your country?

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

The Direct Marketing Communicators Association (DPID) was created in 2005 as part of an initiative designed to establish and implement codes of conduct for its constituents, organise training programmes, strengthen business to business communication and provide solutions to the issues faced by of the sector by encouraging a healthy flow of information between the service providers and recipients. The organisation also aims to prevent unregistered activities and unfair competition between its members by adopting criteria for price determination. DPID is a member of the Federation of European Direct and Interactive Marketing (FEDMA).

In addition to DPID, organisations such as the Turkish Informatics Industry Association (TUBISAD) and the Association of E-commerce Operators (ETID) have become more prominent in Turkey, due to the rising volume of electronic commerce. These organisations, which were formed by leading companies in the electronic commerce sector, aim to advocate for legal developments pertinent to the expansion of the sector, as well as to educate their constituents with respect to the commercial and ethical standards in their field.

The primary advertising self-regulatory body in Turkey is the Advertising Self-Regulatory Board (ROK). Since its foundation in 1994, ROK has been requesting the correction of advertisements it finds to be in breach of the International Code of Advertising Practice. The decisions or statements of ROK are generally not legally binding and there is no obligation for advertisers to comply. However, these decisions are binding for ROK’s members, and the members (consisting of advertising agencies and media service providers) are committed to complying with them. In other words, the non-fulfilment of the requirements in ROK decisions will directly affect the credibility and the reputation of the member-advertiser within society and the sector.

ROK’s main aims are:

  • To ensure that marketing communications adhere to rules that are based on international standards, to provide for the progression of standards and to increase awareness of self-regulation.
  • To remove or amend advertisements that breach the rules without having to recourse to the judicial system.

ROK members consist of advertising agencies, the Turkish Association of Advertising Agencies, advertisers, media members from TV, outdoor media, internet and radio, academics and lawyers. ROK has adopted the International Chamber of Commerce Code of Advertising and Marketing Communication Practice. The key principles of the Code are decency, honesty and truthfulness.

12. What obligations or standards do codes of practice for direct marketing impose upon marketers?

DPID expects its members and stakeholders to adhere to the following code of conduct:

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

  • Compliance with the laws. Members should always act in accordance with the Turkish Constitution, national law and international treaties to which Turkey is a party.
  • Mutual trust. Members should establish healthy communications with other members, share information they do not consider to be trade secrets and act in solidarity to improve the sector.
  • Fair competition. Members should refrain from activities and approaches that may lead to unfair competition, and foster competition on a legal and ethical basis.
  • Respect for our employees. Members should ensure that all personal rights of their employees are fully and accurately exercised. Competence should be the only criterion in recruitment and employment and employees should be provided with equal opportunities.
  • Honesty and clarity. Members should inform their customers about the stages of the service they are providing, with accurate and timely reporting, and ensure uninterrupted communication with their

customers. In this regard, members undertake not to mislead consumers, to respect their consumer rights, and to present their customers with precise information about the products and services they provide.

  • Respect for privacy. Members should respect the personal data of their customers and not use information or documents of this nature without the permission of the consumers. Members should take necessary precautions to prevent the transfer of data to third parties.
  • Avoiding conflicts of interest. Members should act carefully and responsibly to avoid situations and relationships that may present a risk of any conflict of interest.
  • Environmentalism. While aiming to protect the commercial interests and legal rights of our stakeholders, members should also aim to make decisions in accordance with the responsibility to protect the public interest. They should ensure effective use of resources with environmental awareness.

Other codes of practice, such as the International Chamber of Commerce Code of Advertising and Marketing Communication Practice adopted by ROK and general principles of advertising and consumer law also apply to direct marketers.

13. Are there any opt-out lists in your country? If so, how does one register on each list? Which organisation manages each list? What rules apply to each list?

The Trade Ministry has power to authorise a third party to establish an electronic system that enables the receipt of approvals for commercial electronic message and the assertion of the right to refuse (Article 11/4, E-Commerce Law).

The opt-ins and approvals received within the framework of this law must be transferred to the system within the period determined by the Ministry. Approvals that have not been transferred to the system will be deemed invalid. The right of refusal and opt-out by recipients must be used through this system.

Although the former Minister of Trade stated in a press release issued in February 2018 that the Ministry had initiated the procedure to authorise a third party to establish a central electronic system as described above, there have yet to be any developments in this matter.

Direct marketing Q&A: Turkey, Practical Law Country Q&A w-020-9917 (2019)

14. What procedures exist for complaining to organisations against unsolicited communications?

The organisations described in Question 11 do not provide complaint mechanisms for recipients of unsolicited commercial communications. Please refer to Question 1, Question 3 and Question 8 for complaint procedures before the relevant authorities.

First published by Practical Law, 31.05.2019

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.