TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Kübra İslamoğlu Bayer, Simge Yüce and Yiğit Aktimur, YAZICIOGLU Legal
consent may not be required for first-party ana - lytics cookies if: • their use is limited to measuring the site or application’s target audience; • personal data collected through cookies – which are not strictly required for the purpose of processing – is anonymised; • the personal data collected through cookies is only used for anonymous statistics; • the duration of cookies is reasonable, and personal data collected is not transmitted to third parties; and • personal data collected through cookies is not used to track users across multiple sites or devices. 4.2 Personalised Advertising and Other Online Marketing Practices Online Marketing Online marketing is mainly governed by the Law on the Regulation of Electronic Commerce, the By-Law on Commercial Communication and Commercial Electronic Messages (together referred to as the “E-Commerce Legislation”), and the DP Law. According to the E-Commerce Legislation, pri - or approval must be obtained from recipients before making calls or sending SMS or emails for marketing purposes (marketing communica - tion). This approval is a specific authorisation for sending marketing communications and is dis - tinct from the explicit consent required under the DP Law for processing personal data for market - ing purposes. While the Ministry of Commerce, which oversees compliance with the E-Commerce Legislation, does not consider push notifications as market - ing communications, the DPA requires data sub - jects’ explicit consent to send push notifications.
The E-Commerce Legislation provides an exemption for marketing communications sent to tradespeople or artisans in the business-to- business (B2B) context, where their approval is not required, but they must be given the option to opt out. Marketing communication must include the sender’s certain identification information, as well as an option to opt out. All senders of mar - keting communications are required to register with the Message Management System (MMS) and upload information regarding the approv - als and withdrawals for this purpose. MMS is an online platform where recipients can manage their approvals for receiving marketing commu - nications and opt out if desired. Any approval or withdrawal received by the sender must be uploaded to the MMS within three business days of receipt. Personalised Advertising Turkish law does not have specific provisions for behavioural and targeted advertising. There - fore, these activities are subject to general pro - visions of the DP Law. In line with DPA’s gen - eral approach to this matter, in principle, prior explicit consent from data subjects is required for behavioural or targeted advertising. That being said, to the best of our knowledge, the DPA has ruled in an unpublished decision that, in specific cases, controllers may rely on legitimate interest for behavioural or targeted advertising. However, as the details of this deci - sion have not been published, the DPA’s ration - ale behind this decision remains unclear. 4.3 Employment Privacy Law Employment privacy is not governed by a spe - cific, standalone regulation in Turkish law. How -
485 CHAMBERS.COM
Powered by FlippingBook