Explicit consent

Scope

Under the Law, personal data cannot, as a rule, be processed without the explicit consent of the data subject (Art. 5/1); however, explicit consent is not required in the cases listed in Article 5/2, such as where it is expressly provided for in laws, where it is necessary for the conclusion or performance of a contract, for the data controller to comply with a legal obligation, where the data subject has made the data public, where it is necessary for the establishment, exercise or protection of a right, or for the legitimate interests of the data controller. Following the amendment made by Law No. 7499, special categories of personal data can also be processed on conditions other than explicit consent, listed in Article 6/3. In transfers abroad, explicit consent is one of the incidental transfer cases (arızi aktarım) that may be relied on, provided that information about the possible risks is given, when there is no adequacy decision and no appropriate safeguards (Art. 9/6-a). The Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) explains the elements of explicit consent as relating to a specific subject, being based on information, and being declared with free will.

Practical significance

According to the Authority, general consents with an unspecified subject, such as “all kinds of transactions” (“blanket consent”), are regarded as invalid; explicit consent does not have to be in writing and may be obtained electronically or through a call center, but the burden of proof lies with the data controller. A withdrawal statement takes effect from the moment it reaches the data controller, and processing based on explicit consent must be stopped from that moment. If the processing is based on explicit consent, the obligation to inform and the obtaining of explicit consent must be fulfilled separately (Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ), Art. 5/1-f). In practice, therefore, it is first assessed whether another processing condition exists; because explicit consent can be withdrawn, it may not be a secure basis on its own for processing that must be carried out continuously.

Commonly confused concepts

Explicit consent should not be confused with the obligation to inform: informing means providing information about the identity of the data controller, the purpose of processing, transfers and the legal basis, and is fulfilled whichever condition the data is processed on (Art. 10); explicit consent, by contrast, is the data subject’s approval. If the processing of data belonging to the parties is necessary in direct connection with the conclusion or performance of a contract, the processing is based not on explicit consent but on the condition in Article 5/2-c.