The Personal Data Protection Board “(“Board””) has published its decisions regarding the complaints submitted to it on the allegations of unlawful processing of personal data on various issues on its website on 18.07.2022. A summary of some of the published decisions we consider significant is submitted for your information in 5 parts.
The Board’s Decision dated 05.07.2019 and numbered 2019/198 on the unlawful processing of personal data by the data controller within the scope of the loyalty program
The following issues were briefly mentioned in the complaint petition, which is the subject of the ‘Board’s Decision:
- Special discount to loyalty cards is applied to some products sold in the store of the data controller; thus, special discounts are made conditional;
- The customer’s personal data is requested, and explicit consent is imposed as a condition for membership in the loyalty program and card supply.
In this regard, it was requested by the Board to take necessary action.
In the letter sent by the data controller to the Board upon the complaint of the data subject, the following issues were addressed:
- The element of explicit consent being related to a particular topic is provided by listing the purposes of the explicit consent clearly in the text of explicit consent submitted to the data subject who wants to be included in the loyalty program;
- While presenting an explicit consent text to the data subject, it is also clarified in accordance with the legislation regarding the processing of personal data and their rights;
- Within the scope of the loyalty program, the data subject who does not want to give their explicit consent are always offered the opportunity to shop through its stores and websites; everyone can access the products and services and provide these at determined prices and discounts on these products and services are below the market price of the product or service and are an additional benefit;
- The discounts that can be used within the program and in case of giving explicit consent by the data subject are not related to the offering of the main product or service but are in the nature of an additional benefit, and this shows that obtaining the explicit consent of the data subject is not put forward as a prerequisite for offering or benefiting from a product or service;
- It is also clearly accepted in the European Union legislation that the condition of placing additional benefits which are so small that they do not affect the free will of the data subject on the condition of explicit consent will not abolish the condition of “given the explicit consent with free will.”
As a result of the investigation carried out on the subject, the Board has determined that the opportunity to shop at the stores of the data controller for the persons who do not want to be included in the loyalty card program and/or who do not want to give their explicit consent within the scope of the program is not removed, and that sales are continued at non-discounted prices to customers who are not members of the loyalty program. However, in the Decision, it was stated that offering products/services at a discount with additional benefits within the scope of the loyalty program do not mean that explicit consent is imposed as a condition. Accordingly, the Board decided that there was no action to be taken.
You may access the Decision by this link.
To see our other articles, you may follow the NSN Bulletin via the link.
Authors: Bilge Derinbay, Hande Ülker Pehlivan, Bengisu Çakırca
Contact: bilge.derinbay@nsn-law.com