New Policy Decision from the Board: Explicit Consent and Information Notices to Be Regulated Separately

I. Common Mistakes
 

Presenting the clarification text and the explicit consent text to data subjects in an intertwined manner is considered one of the most common unlawful practices encountered in notifications and complaints submitted to the Board. Based on this determination, the Board summarises the frequently encountered unlawful practices as follows:
 

• Presenting the clarification text and the explicit consent text as a single text in an intertwined manner,
   

• Requesting approval or explicit consent from data subjects while fulfilling the obligation to inform (e.g., "I have read and accept", "I have read and give explicit consent", "I have read and approve"),
   

• Using texts belonging to other data controllers without adaptation,

• Texts not being clear, plain, and understandable,
   

• Use of overly detailed, complex, and lengthy texts.

Such practices are incompatible with the purpose of the obligation to inform and create a risk of unlawfulness.

II. What Should the Proper Practice Be?
 

According to the Cautionary Resolution published by the Board, the proper practice should be as follows:
 

• The obligation to inform must be fulfilled prior to the data processing activity and in all circumstances,
   

• In data processing activities based on explicit consent, the clarification text and the explicit consent text must be prepared under separate headings and as separate texts,
   

• Even if the texts are presented on the same page, separate declarations must be obtained for each,
   

• Clarification texts should not request approval or explicit consent; instead, informative statements should be used (e.g., "I have read and understood"),
   

• Texts must be prepared specifically in line with the activities of the data controller,
   

• A clear, plain, and understandable language must be used,
   

• The categories of personal data processed, purposes of data processing, and legal grounds must be clearly and explicitly specified.
   

III. Conclusion and Assessment
 

The Board has stated that the matters set forth in the Cautionary Resolution fall within the administrative and technical measures that must be taken by data controllers under Article 12 of the PDPL and explicitly indicated that action will be taken pursuant to Article 18 of the PDPL in case of non-compliance with these matters.
 

Accordingly, it is of great importance for data controllers to clearly separate their clarification obligations from their explicit consent processes and to review their existing texts accordingly. We recommend reviewing and revising clarification texts and explicit consent texts by considering the points outlined above under "Section II. What Should the Proper Practice Be?"