Personal Data Protection Board Resolution No. 2020/966 dated 22.12.2020

31 January 2021

Personal Data Protection Board Resolution No. 2020/966 dated 22.12.2020

The following information is regarding the "22.12.2020 dated 2020/966 numbered Resolution of the Personal Data Protection Board (the “Board") which is published on 15.01.2021 dated and 31365 numbered Official Gazette, on personal data of third parties which were sent illegally by data controllers via communication channels such as phone number, the e-mail address of persons.”

It is seen that data subjects are asked to declare their phone numbers and/or e-mail addresses in order for the data controllers to sent the documents containing their personal data such as invoices, statements, booking documents via SMS and/or e-mail, however, there may be inaccuracy in declaration of such information by the relevant persons or, as a result of the declaration of information belonging to third parties by the relevant persons, the documents which contain the data of the relevant persons are forwarded to third parties.

It is regulated that certain principles should be followed in the processing of personal data in which personal data can only be processed in accordance with the procedures and principles that stipulated in the relevant legislation. One of them is that personal data is "accurate and up-to-date when it is necessary." Accordingly;

- if there is a conclusion made in relation to the relevant person by considering his/her personal data in question, the data controller has an active due diligence obligation in order to ensure that the personal data is accurate and up-to-date when it is necessary;

- it is important that the data controller always make all the channels available to ensure that the relevant person's information is accurate and up-to-date when it is necessary, for this reason, it is necessary to take reasonable measures and all necessary technical and administrative measures to ensure the appropriate level of security in order to verify the contact information declared by the relevant persons (sending a verification code/link to the phone number and/or e-mail address, etc.) within the scope of the determination of the source from which the personal data is obtained and the accuracy of the source from which the personal data is collected and prevention of negative consequences for the relevant persons due to the inaccuracy to obtain the personal data.

You can find the full text of the Resolution in the following link