Public Announcement Regarding the Processing of Personal Data by Sending a Verification Code via SMS to Data Subjects during Shopping in Stores
On November 13, 2023, the Personal Data Protection Authority (“KVKK“) published a public announcement regarding the processing of personal data by sending a verification code via SMS to the relevant persons during shopping in stores.
As a result of the evaluations made by the Personal Data Protection Authority regarding the announcement;
- Store authorities should explain the purpose of the code transmitted via SMS sent to the phone of the relevant persons during the cash register transactions during store shopping and the consequences of the code if the code is given.
- In particular, if the data processing activities are carried out based on the explicit consent of the data subjects, the obligation to inform and the procedures for obtaining explicit consent must be fulfilled separately.
- During the payment transactions in the stores, the explicit consents of the relevant persons should not be obtained at a single time (for example, approval of the membership agreement, consent to process personal data and consent to receive commercial electronic messages, etc.) and the explicit consents should be obtained separately.
- Processing personal data by sending commercial messages should not be presented as a condition of shopping. Otherwise, this practice will cause the elements of “Disclosure Based on Information and Free Will“, which is one of the elements of explicit consent, to be crippled.
- It is important that the explicit consent regarding the sending of commercial electronic messages is requested after the completion of the shopping in order not to be perceived as one of the elements of the completion of the shopping.
You can access the relevant announcement on the authority’s website.
Please do not hesitate to contact us for more detailed information.