Obligation to Inform and Explicit Consent in the Context of Protection of Personal Data

1)Introduction

In connection with economic and technologic improvement, data on individuals are collected by real and legal persons. The conditions for data collection and processing are placed on a legal basis in our country as well as all over the world. With the Law on Protection of Personal Data published in the Official Newspaper on April 7, 2016 and numbered 29677, a legal framework for the protection of recorded personal data belonging to individuals with whom real and legal persons interact. The Law on Protection of Personal Data numbered 6698 complies with General Data Protection Regulation (on April 27, 2016 and numbered 2016/679) and Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data(on January 28,1981 and numbered 108). Protection of personal data is very important in terms of privacy and general security.

The data controller is the natural or legal person who determines the purposes and tools of processing personal data and is responsible for the creation and management of the filing system. Data controllers should pay attention to the explicit consent of the person concerned regarding the protection of personal data and data processing activities. In order to process personal data, the person concerned must be informed about it and consent must be obtained, except as provided for by law. In Article 5 of the “Communique On Principles And Procedures To Be Followed In Fullfillment Of The Obligation To Inform” dated 10 March 2018, the necessity of explicit consent and obligation to inform is emphasized:

Principles and procedures
ARTICLE 5 – (1) The following procedures and principles shall be followed at the time of the fulfilment of the obligation to inform by the data controller or the person authorized by it by using physical or electronic media such as oral or written statement, voice recording, call centre:
.
.
.
f) In the event that processing personal data is on the basis of explicit consent, procedures of the obligation to inform and obtaining explicit consent shall be performed separately.

When collecting personal data, a person must have his explicit consent, which he declared as a result of his knowledge and knowledge of the transaction. Otherwise, data officers will be under legal and criminal responsibility.

2)The Concept of Explicit Consent in Protection of Personal Data

Explicit consent is defined as freely given and informed consent. Explicit consent of the person concerned is required to process personal data, with exceptions. Data processing will only be possible if this explicit consent exists.
Explicit consent has three elements. These are explicit consent related to a particular subject, consent based on information and explanation of consent with free will. First of all, the framework of the subject to be given consent by the person concerned should be clearly drawn by the data controller. Secondly, the consent of the person concerned should be given at the end of an information process. Finally, the consent given must be a declaration of will
that is the result of free will.

Explicit consent doesn’t depend on any form of condition.Explicit consent; provided that it carries the elements of the law and is provable, written, oral, electronic, etc. can be taken in ways.

3) Obligation to Inform in Protection of Personal Data

a)Information Obligation of Data Controllers
The obligation to inform is the obligation to provide information to the concerned persons whose personal data is processed by the data controllers or the persons they authorize. This information is about who will process the data and for what purpose. The data controller is obliged to provide information within the scope of the lighting obligation before processing the personal data. This obligation is a fundamental right for the protection of personal data
for the person whose personal data is processed. Regarding this right in article 20 of our Constitution:
A. Privacy of private life
ARTICLE 20
.
.
“Everyone has the right to request the protection of his/her personal data. This right includes being informed of, having access to and requesting the correction and deletion of his/her personal data, and to be informed whether these are used in consistency with envisaged objectives. Personal data can be processed only in cases envisaged by law or by the person’s explicit consent. The principles and procedures regarding the protection of personal data shall be laid down in law.”

b) The Basis and Scope of Obligation to Inform
In Article 10 of the Law No. 6698 on the Protection of Personal Data, the basis and scope of the obligation to inform are shown:

Data Controller’s Obligation to Inform
ARTICLE 10 – (1) Data controller or the person it authorized is obligated to inform the data subjects
while collecting the personal data with regard to
a) The identity of the data controller and if any, its representative,
b) The purposes for which personal data will be processed,
c) The persons to whom processed personal data might be transferred and the purposes for the
same,
ç) The method and legal cause of collection of personal data,
d) The rights set forth under article 11.

In order to fulfill the obligation of information, information should be given by the data controller on the subjects listed in the minimum Article 10. First of all, the person concerned should be informed about the identity of the data controller and if any, its representative ;the purposes for which personal data will be processed ;the persons to whom processed personal data might be transferred and the purposes for the same and the method and legal cause of collection of personal data.The person to be enlightened will also be informed about his rights regulated in Article 11 of the Law.The data controller or his authorized persons are obliged to comply with the law and the notification issued regarding the implementation of the information obligation while fulfilling the information obligation. These issues shown in the law are kept to a minimum and mandatory. More comprehensive inform is possible, including these issues, by data controllers or authorities.The law does not impose any restrictions on how the obligation of inform should be fulfilled. Obligation to inform can be fulfilled by many alternative methods. It is possible to be informed verbally by the data controller or the authorized person. In addition, the obligation of inform can be fulfilled with the letter to be posted on the website or the information letter to be hung on the places of duty. With the developing technology, information can be sent electronically.

4)Obligation to Inform In Cases Where The Personal Data Cannot Be Object From Data Subject

Data controllers may sometimes face the problem that personal data cannot be obtained from the related people. This problem brings with it the problem of how to fulfill the obligation of inform before the data procession. In Article 6 of the “Communique On Principles And Procedures To Be Followed In Fullfillment Of The Obligation To Inform” dated 10 March 2018, the necessity of explicit consent and obligation to inform is emphasized:

ARTICLE 6 – (1) In cases where personal data are not obtained directly from data subjects; the obligation to inform shall be fulfilled:
a) within a reasonable time following the obtainment of the personal data,
b) at the first instance of communication in case personal data are used to communicate with the
data subject,
c) at the time of the first transfer of personal data at the latest in case personal data are to be
transferred.

Av.Erdem ARDA AKAY Av. Yalçın TORUN

UYARI
Web sitemizde yayımlanan yukarıdaki yazılı metnin, eser sahipliği hakları Av.Yalçın TORUN’a ve Av.Erdem Arda AKAY’a aittir. Bu yazılı metin hak sahipliğinin tespiti amacıyla zaman içerikli elektronik imza ile muhafaza edilmektedir. Sitemizdeki yazılı metinler avukat meslektaşlarımız tarafından dilekçelerinde serbestçe kullanılabilir, fakat metinlerin
tamamının, bir kısmının veya özetinin atıf yapılmaksızın başka web sitelerinde yayınlanmasına iznimiz yoktur