In the public announcement (“Announcement”) of the Personal Data Protection Authority (“Authority”) dated 13th November 2023, statements regarding the complaints and notices received by the Authority on the commercial electronic message transmission by stores in a manner contrary to the relevant legislation, following the submission of verification codes via SMS to customers during the cash register transactions in stores to complete the payment, were included.
In this context, the importance of paying attention to the following issues regarding store practices has been emphasized by the Authority, based on issues such as not providing information to individuals in accordance with the Personal Data Protection Law No. 6698 (“Law”), the explicit consents received not containing the elements required in accordance with the Law, and not obtaining approval for commercial electronic message sending:
- The purpose of the SMS message sent to individual’s phones during cash register transactions in the store and the consequences of giving the verification code should be conveyed clearly and understandably by the store officials, and the necessary information channels should be included in the SMS content.
- Practices that aim to carry out different processing activities with a single action by sending a verification code to the relevant persons via SMS, such as the conclusion of the membership agreement, obtaining explicit consent for personal data processing, obtaining consent for commercial electronic communication etc., should be ceased, and explicit consent should be obtained separately by providing option for activities that must be carried out with explicit consent.
- Obtaining explicit consent by data controllers and fulfilling the obligation to inform must be carried out separately.
- If an SMS verification code is sent for commercial electronic communication consent, the consent must cover all the elements specified in the Law.
- Explicit consent for commercial electronic communication should not be presented as mandatory for the completion of the shopping; in this context, the explicit consent should be requested after the completion of the shopping.
You can access the full text of the relevant Announcement below.
