SMS messages sent for advertising purposes without the request of the person concerned are a situation that every phone user complains about. Although most people ignore this situation because they do not know how it can be solved or care, ad SMSs which are sent without the consent of the relevant person cause serious violations in terms of protecting personal data. According to the Law No. 6698 on Protection of Personal Data, the personal data of the relevant person can only be processed based on the clear consent of a specific subject, based on information and with free will, or the presence of the conditions listed in Paragraph 2 of Article 5 of the Law.
1) It is expressly permitted by any law;
2) It is necessary in order to protect the life or physical integrity of the data subject or another person where the data subject is physically or legally incapable of giving consent;
3) It is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract;
4) It is necessary for compliance with a legal obligation which the controller is subject to;
5) The relevant information is revealed to the public by the data subject herself/himself;
6) It is necessary for the institution, usage, or protection of a right;
7) It is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.
However, in cases where  none of the above-mentioned situations exists, there will be a violation of the protection of personal data. In this case, the person whose personal data is processed can benefit from the rights granted to him in Article 11 of Law No. 6698.
Rights of Data Subject
By applying to the data controller, everyone, in connection with herself/himself, has the right to;
1) Learn whether or not her/his personal data have been processed;
2) Request information as to processing if her/his data have been processed;
3) Learn the purpose of processing of the personal data and whether data are used in accordance with their purpose;
4) Know the third parties in the country or abroad to whom personal data have been transferred;
5) Request rectification in case personal data are processed incompletely or inaccurately;
6) Request deletion or destruction of personal data within the framework of the conditions set forth under article 7;
7) Request notification of the operations made as per indents (d) and (e) to third parties to whom personal data have been transferred;
8) Object to occurrence of any result that is to her/his detriment by means of analysis of personal data exclusively through automated systems;
9) Request compensation for the damages in case the person incurs damages due to unlawful processing of personal data.
The data subject shall convey her/his requests relating to the enforcement of this Law to the data controller in writing or by other means designated by the Board. The data controller shall conclude the requests included in the application free of charge and as soon as possible considering the nature of the request and within 30 days at the latest. In case the application is rejected, replied insufficiently, or not replied in due time; the data subject may file a complaint with the Board within 30 days following the date he/she learns the reply of the data controller and in any event, within 60 days following the date of application. Complaint remedy cannot be applied to without exhausting the application remedy set forth under article 13. Compensation rights of the ones whose personal rights are violated are reserved.
Considering the Board’s decisions regarding the SMS received for advertising purposes, the most important points are how personal data is reached and for what purpose it was shared by the relevant person. In the Board's decision dated 27/01/2020 and numbered 2020/67, the relevant person complained about the advertisement SMSs and notifications sent by a real estate company without his consent, and the data officer claimed that the data including the name, surname and telephone number of the records were obtained from public sources over the internet. As a result of the examination made by the Board, the following decision was made:
“... if a person's personal data is in a place where it can be seen does not make it public, in case of publicization it should be used for the purpose of publicizing, in the concrete incident, even if there is publicization, he did not publicize the personal data in order to communicate with him about the advertising activities, it is evaluated that the personal data processing activity to be carried out will not be in accordance with the law,
It has been decided to impose an administrative fine of 50,000 TL on the data controller in accordance with the subparagraph of paragraph 1 of Article 18 of the Law based on the fact that article 12 of the Law constitutes a violation of the paragraph 1 since the express consent of the relevant person was not obtained for the personal data processed in the concrete event, other situations where explicit consent is not sought are absent and in this context, the personal data of the person concerned is used for the purpose of sending messages with advertising content without complying with the conditions in article 5 of the Law.’’
In the Board's decision dated 16/01/2020 and numbered 2020/34, upon the application of the person complained about receiving ad messages related to food company after sharing his personal data for sports magazine and the data collector claimed that he was responsible for food company and also sport company and becauase of a server error, the relevant person received the message but his personal data was deleted as a result of his application.. Following conclusions were made by the Board:
".. It is believed that the data is used for a different purpose than the first purpose of the data, that is, it is violating the principle of data being connected and limited for the purpose which is stated in article 4 of the Law."
“... in order to bring the data into compliance with the Law within two years after the publication of the Law; After the contract signed between the data collector for providing call center service for sports magazine subscription and the related sports club ended in 2015, the data should be deleted since the purposes of processing of the data are eliminated, although the data is intended to be processed by the data controller for different purposes, it is understood that the relevant person's Express consent regarding the processing purposes should be obtained, but that these operations are not carried out ... ”
“Although it is declared by the data controller that the relevant person's number was deleted, the system called the number as a result of an error, but it is an indication that the deletion of the related person's number was not performed properly , and it was evaluated that the data officer acted against the provision of "preventing the illegal processing of personal data" in paragraph of article 12 of the Law and Based on the issues, it was decided to impose an administrative fine of 18,000 TL within the scope of subparagraph of paragraph of Article 18 of the Law. ”