1. What is explicit consent?
As per the Law on the Protection of Personal Data No. 6698 (“
Law”), explicit consent is defined as “
freely given, specific and informed consent”. According to this definition, explicit consent can be explained as the approval related to a specific issue and is expressly given by duly informed natural person with a free will.
By means of the explicit consent, the person who authorizes the processing of its data will also determine which personal data will be processed, to what extent this personal data can be used, in which ways the data will be processed and for how long the data can be processed.
2. What are the elements of express consent?
As per the definition in Article 3 of the Law, it can be said that there are 3 fundamental elements of explicit consent:
i. Explicit consent must be given in relation to a particular subject.
In order for the explicit consent to be valid, it must be given for a specific issue. In this respect, broad and ambiguous statements that can be interpreted in different manners such as “I agree to the processing of my personal data” or “I consent to the processing of my data in relation to all kinds of commercial transactions and all kinds of matters” cannot be accepted as legally valid express consent. Therefore, it is necessary to expressly determine which personal data are processed for which purposes. If the personal data is planned to be processed for a purpose out of the scope of the consent, additional consent must be obtained for this purpose. In short, when processing personal data, the principle of "limited purpose" and "specific subject" should be taken into account.
ii. Explicit consent should be given by an “informed” data subject.
Before requesting explicit consent, the data controller should inform the data subject in a clear, comprehensive and understandable manner on who is the data controller, which data it will process for what purposes. Data controller should also inform the data subject that the express consent can be withdrawn.
In addition, information should be clarified on points that the data subject does not understand. Such information can be made in writing or verbally. However, the burden of proof regarding the information of the data subject is on the data controller.
iii. The explicit consent has to be given with free will of the data subject.
Explicit consent based on free will is particularly important in circumstances where the parties are not equal such as employee-employer relationship. In such circumstances, the data controller must provide the data subject with the opportunity not to give its explicit consent regarding the information. Otherwise the explicit consent cannot be deemed as valid.
3. How is explicit consent given?
Explicit consent is notifying the data controller with a positive statement of will regarding the processing of personal data. Without prejudice the provisions included in the other laws and regulations, explicit consent does not required to be provided in written form as per the Law. The data controller can also obtain the explicit consent of the data subject in different ways (via the website or by telephone etc.). However, the burden of proof regarding the explicit consent is on the data controller.
4. Can explicit consent be withdrawn?
It is a personal right to give explicit consent for the processing of personal data, as well as to withdraw the explicit consent at any time. The data controller is obliged to cease the data processing activities from the moment the withdrawal declaration of the explicit consent is received.
5. Can explicit consent be demanded as a pre-condition for providing a service?
No. If explicit consent is requested from the data subject as a pre-condition for a service or product (if the service would not be provided or the product would not be sold without the explicit consent), such consent cannot be considered as legally valid.
6. Can explicit consent be obtained despite the processing conditions existing in the Law?
No. As per the Law, personal data may be processed without seeking the explicit consent of the data subject only if:
(i) It is explicitly provided for by the laws,
(ii) It is mandatory for the protection of life or to prevent the physical injury of a person, in cases where that person cannot express consent or whose consent is legally invalid due to physical disability,
(iii) Processing of personal data belonging to the parties of a contract is necessary provided that it is directly related to the conclusion or performance of that contract,
(iv) It is mandatory for the controller to perform its legal obligations,
(v) The data is made available to the public by the data subject itself,
(vi) Data processing is mandatory for the establishment, exercise or protection of any right,
(vii) It is mandatory for the legitimate interests of the controller, provided that such processing shall not violate the fundamental rights and freedoms of the data subject.
In practice, data controllers demand explicit consent of the data subjects, even in cases where data processing is permitted without the need for explicit consent.
It should be noted that obtaining explicit consent in case of the above circumstances is misleading and deemed as an abuse of rights by data controller. In such a case, the data subject would be given the impression of having the right to withdraw its consent at any time. However, the necessary authorization for the processing of the data does not originate from the explicit consent of the data subject, but from the processing conditions specified in the Law. In other words, even if the data subject withdraw its consent in this case, the data controller would continue to process the data.
Therefore, obtaining explicit consent in the above-listed cases misleads the data subjects, and is deemed unlawful.