Is the Advertisement Board Opening a New Front in the Protection of Personal Data?
Contents
- A. Main Ideas in the Decisions and Evaluations of the Advertisement Board
- B. Doesn’t the Turkish Data Protection Authority Oversee These Matters?
- C. Risk of Double Penalization
- D. How Should the Risk Be Calculated?
- E. Conclusion
The monthly bulletins of the Advertisement Board decisions, which are regularly published on the website of the Ministry of Trade, include some intriguing decisions in the March bulletin - especially for those offering goods/services through an online membership system. In general, some of the decisions are similar to those previously published by the Advertisement Board. However, there are certain decisions that focus on personal data, which raise the question of whether a new front is emerging in the protection of personal data. Before answering this question, a brief overview of the main ideas of these decisions and the evaluations of the Advertisement Board...
A. Main Ideas in the Decisions and Evaluations of the Advertisement Board
Although the Advertisement Board has included 12 decisions[1] on this topic, essentially the same issues have been addressed in almost all the decisions. Therefore, we have focused on these common points in our explanations and compiled the main ideas to be drawn from these decisions as follows:
Main Idea | Evaluations of the Advertisement Board |
Offering an option to shop without membership | ü Consumers wishing to access goods and services offered through the website should also have the option to take advantage of these goods and services “without being a member”. Therefore, in addition to options such as “Log In” and “Sign Up”, consumers should also be offered the option of “Continue without Membership”.
ü The "Continue without Membership" option offered to consumers should not be in a different colour and smaller font size than other options, thus, should not manipulate the consumer's preference.
ü The checkboxes presented to consumers should not be pre-checked/filled. |
Not forcing consent for targeted advertising and/or marketing practices and/or sending commercial communications | If consumers' personal data will be processed for targeted advertising and/or marketing purposes, or if commercial electronic messages will be sent to consumers, they must be: ü Informed about such processing. ü Provided with a real choice to give or withhold their consent, and not be coerced into giving consent(s). ü Given the opportunity to change their choices later. |
Providing an option to opt out of membership and/or not making membership cancellations difficult | ü If there is a membership system, an option to opt out of the membership should be provided, and consumers should be duly informed.
ü The method for opting out of membership should not be more difficult than the method used for joining the membership system. |
Not collecting personal data that is not related to becoming a member and/or provision of goods/services | ü Consumers wishing to take advantage of goods and/or services offered on a website should not be forced to provide information that is not necessary for the provision of these goods and/or services to the consumer (e.g., gender information). |
In all its decisions, the Advertisement Board has considered these commercial practices as unfair commercial practices and has therefore decided for them to be suspended and rectified[2] accordingly. The Advertisement Board settling for issuing suspension and rectification decisions in almost all its decisions on the subject -given that it has not conducted such examinations before- should be considered as a serious warning for the future.
B. Doesn’t the Turkish Data Protection Authority Oversee These Matters?
As is known, the issues that have recently found a place in the decisions of the Advertisement Board have long been on the radar of the Turkish Data Protection Authority (the “DP Authority”), and the DP Authority has issued numerous violation decisions on these topics. Thus, it is a well-known fact that such practices are against the law. However, at this stage, questions such as "who has the authority to detect and penalize non-compliance" and "will two separate administrative authorities impose penalties for the same issue" have emerged.
When the establishment, authority, and duty areas are compared, personal data are located in the focal point of the DP Authority's field of work. On the other hand, the Advertisement Board’s field of work focuses on consumer protection, regulation of commercial advertisements, and prevention of unfair commercial practices. Therefore, the current decisions indicate that the Advertisement Board interprets its own field of work to cover the instances where personal data is unlawfully processed. Indeed, careful examination of these decisions reveals that instead of the legislative jargon of the Data Protection Law, the Advertisement Board uses its own legislative jargon: Unfair Commercial Practice.
As it appears, the Advertisement Board has now indicated its active involvement in such unlawful situations.
C. Risk of Double Penalization
The outcome of the involvement of different administrative authorities, as briefly discussed above, is the risk of double penalization for the same conduct, whether it is called unfair commercial practice or unlawful processing of personal data.
This risk can be stated comparatively as follows:
Non-compliance | The DP Authority | Non-compliance | The Advertisement Board |
Failure to Fulfil the Disclosure Obligation (Obligation to Inform) | (i) An administrative fine ranging from TRY 47,303 to TRY 946,308 (approx. EUR 1,360 to EUR 27,180) and
(ii) Suspension of personal data processing in cases of damages that are difficult or impossible to compensate for, and in the event of explicit infringement of the law. | Unfair Commercial Practice: Using methods on the internet such as deceptive interface designs, options, or statements that negatively affect consumers' decision-making ability or choice or aim to alter decisions they would give under normal circumstances in favour of the seller or provider. | (i) Temporary suspension of the unfair commercial practice for up to three (3) months, or a suspension sanction; or
(ii) An administrative fine of TRY 54,987 (approx. EUR 1,580). The Advertisement Board may impose these sanctions separately or together depending on the nature of the violation. If the violation has occurred nationwide, an administrative fine of TRY 550,059 (approx. EUR 15,800). |
Unlawful Processing of Personal Data (Breach of Data Security) | (i) An administrative fine ranging from TRY 141,934 to TRY 9,463,213 (approx. EUR 4,080 to EUR 271,830) and
(ii) Suspension of personal data processing in cases of damages that are difficult or impossible to compensate for, and in the event of explicit infringement of the law. |
D. How Should the Risk Be Calculated?
Per Article 15 of the Misdemeanours Law, if multiple misdemeanours are committed with one conduct, the highest of the administrative fines provided shall be applied. If the law also provides for other administrative sanctions for these misdemeanours, each of these sanctions shall be imposed.
If multiple misdemeanours stem from one conduct and this situation is evaluated by the same administrative authority, it is clear that the highest administrative fine will be imposed. However, the problem arises when the same conduct is examined by more than one administrative authority. For example, considering the ex officio investigation powers of the DP Authority, what should be the assessment if the DP Authority acts upon these decisions as a denunciation? Or else, what interpretation can be made if the administrative authorities are unaware of each other? The answers to these questions remain unclear. Therefore, when calculating the risks arising from such practices, the total of the risks indicated in the table above should be considered.
E. Conclusion
On a final note, such practices are increasingly falling under the radar of more regulatory and supervisory administrative authorities. Therefore, it is important for those offering goods and/or services online to review their membership systems in line with the Advertisement Board decisions and complete their compliance processes as soon as possible.
[1] These decisions are from the case files numbered 2023/149, 2023/150, 2023/151, 2023/152, 2023/153, 2023/326, 2023/327, 2023/328, 2023/329, 2024/2262, 2024/2263, and 2024/2266.
[2] In addition to the decision to suspend and rectify, the Advertisement Board has also decided to impose an administrative fine of TRY 347,128 (approx. EUR 9,970) on only one of these decisions. However, upon examining this decision, it is evident that similar findings to those in the other decisions have been made. Therefore, it is not understood from the text of the decision why this decision did not suffice with the suspension and rectification order as in the other decisions. (File No: 2024/2262)
Successful