The Board made the following explanations regarding the complaint;
Cookies that are necessary for the proper functioning of a website are defined as essential cookies and can be used as exception to the explicit consent requirement in Article 5 of the Law on the Protection of Personal Data No. 6698 (“DPL”). However, the cookies used for advertising, marketing, and performance purposes are subject to the explicit consent of the data subject. If there is no processing condition other than explicit consent regarding the cookies other than essential cookies such as functional cookies, performance-analytical cookies, and advertising/marketing cookies, the data controller must obtain explicit consent from data subjects according to the “opt-in” mechanism that envisages their voluntary active action at the time of log-in, and preventing the cookies being active in default.
In this regard, the Board adopted the following decisions;
The data controller processes personal data through non-essential cookies for the purpose of advertising and marketing without relying on any legal basis on the relevant website. Since this situation constitutes a violation of the obligations in Article 12 of the DPL, an administrative fine of TRY 300.000 (approx. EUR 14.036) was imposed on the data controller.
In terms of personal data processed with cookies on the website, it has been decided to instruct the data controller to fulfill the obligation to inform in accordance with the relevant provisions of Article 10 of the DPL and the Communique on Principles and Procedures to be Followed in Fulfillment of the Obligation to Inform.
Authors: Burak Özdağıstanli, Bensu Özdemir, Ebru Gümüş