KVKK Principle Decision: A New Era in SMS Communications
The Personal Data Protection Authority has published an important principle decision regarding the processing of personal data through the sending of verification codes via SMS during the provision of products and services.
The decision contains critical regulations regarding the use of verification codes sent during payment, registration, and membership creation processes, as well as commercial electronic communication approval processes.
The following points are emphasised in the principle decision published by the Board:
- Relevant individuals must be provided with clear and understandable information about the purpose and consequences of verification codes sent via SMS.
- The information process must be provided through a layered approach, both by the data controller’s employees and via SMS content.
- Practices whereby different personal data processing activities, such as obtaining consent for membership, payment approval or commercial electronic communications, are carried out in a single action must be discontinued.
- The processes of obtaining explicit consent and fulfilling the information obligation must be carried out independently of each other.
- Consent for sending commercial electronic communications should not be presented as a mandatory condition for the provision of a product or service, and the principle of free will must be guaranteed.
- Consent for data processed for commercial communication purposes should be requested after the service has been provided; the relevant person should be clearly informed that the service can always be provided even if the code is not provided and that permissions can be changed at any time.
- Data controllers should periodically conduct the necessary training and awareness activities for their personnel involved in the process.
This principle decision highlights the need for data controllers, particularly those involved in intensive marketing and commercial electronic communication activities, to review their processes and bring them into line with current practices.