Two-Minute Recap Of Recent Developments In Turkish Data Protection Law

DPA's Landmark Consent Ruling on Marketing

The Personal Data Protection Board ("DPA") issued a significant ruling regarding unsolicited commercial electronic communications. The Board found that a data controller's use of an individual's contact information for marketing calls and SMS messages without obtaining explicit consent constitutes unlawful processing under the Personal Data Protection Law No. 6698 ("Law"). It emphasized that not only the act of calling or sending messages but also retaining contact details in the system for marketing purposes qualifies as personal data processing. Furthermore, the data controller failed to meet its transparency obligations and deprived the data subject of accessible communication channels. Consequently, the DPA imposed an administrative fine of TRY 300,000 for breaching data security obligations under the Law. This ruling clearly establishes the Board's strict stance against marketing activities conducted without explicit