DPA Issues Principle Decision on Separation of Consent and Privacy Notices
The Turkish Data Protection Authority (“DPA”) has issued a principle decision requiring that explicit consent and privacy notices be presented separately to data subjects.
The Authority identified the use of combined texts as a common compliance issue and emphasized that the obligation to inform must always be fulfilled prior to the processing of personal data, regardless of the legal basis relied upon. Where processing is based on explicit consent, consent and privacy notices must be structured as separate texts, even if presented on the same page under distinct headings. Conversely, where processing relies on other legal grounds, data controllers should not request explicit consent in addition to fulfilling their obligation to inform.
