Personal Data Protection Board’s principle decision dated 16/10/2018 no.2018/119 concerning the prevention of advertorial notifications/calls to the e-mail addresses or SMS or calls to mobile phones of related people by the data controllers and data processors.

Taking the findings obtained within the scope of the investigations carried out in this context with a large number of applications into consideration that the relevant persons are notified by their e-mail address or by SMS or call and by their mobile notices without their explicit consent as contrary to the provisions of Personal Data Protection Law no.6698; it was unanimously decided to publish this principle decision in the Official Gazette and the web site of the Authority and inform the public concerning the decisions provided below;

• The data controllers forwarding posts containing advertorial content to the e-mail addresses or SMS or calls to mobile phones of related people without their explicit consent and meeting the terms related to data processing indicated in the article 5 of the Law and data processors using that data in the name of data controllers’ immediately finalizing these activities as per the 7^th clause of article 15 within the Law,
• In accordance with Article 12 of the Law, the data officer has to take all necessary technical and administrative measures to ensure that the personal data is not illegally processed, to prevent unlawful access to personal data and to ensure the appropriate level of security in order to maintain the personal data and if the personal data is processed by another natural or legal person on his/her behalf, they are jointly responsible for taking such measures,
• The procedure will be established within the context of the provisions of Article 18 of the Law about data controllers involved in such activities as specified,
• Taking into account the fact that the personal data handled in this way may have been obtained unlawfully,
• Taking into account the fact that the personal data handled in this way may have been obtained unlawfully, pursuant to the article 136 of the Turkish Criminal Procedure Code no.5237 titled as “Delivering or grasping of the data illegally”, for the handling of necessary legal proceedings about the concerning data controllers, the relevant Chief Public Prosecutor's Office will be notified of the matter pursuant to Article 158 of the Law.