After the number of complaints to the Personal Data Protection Authority ("Authority"), the Authority published a Public Announcement on "Personal Data Processing Activities of Research Companies by Using "Random-Digit Dialing as a Method of Telephone Sampling" for the purpose of Statistical Research" ("Public Announcement").
What does the Subject of Complaints?
It is related to the fact that although the persons concerned did not share their telephone numbers with the research companies in any way, they were called by the research companies and they were not informed about this issue.
The Arguement of Research Companies
The research companies stated that the telephone numbers are randomly and automatically generated by the system/software and that the method used for the calls is a statistical methodology known as the "random-digit dialing as a method of telephone sampling" method, which is applied worldwide. They also expressed that they obtain the consent of the data subjects; if the consent is not given by the data subjects, they retain data by Pseudonymisation method.
The Authority's Detection
The following assessments are made by the Authority regarding the incident in question.
- Since the person can be identified through the automatically generated telephone number, the processing of personal data is involved.
- If personal data is retained using the Pseudonymization method, personal data processing will still be relevant. This method is not an anonymization technique.
- Compliance with the principles of privacy by design and privacy by default must be ensured. The data controller should implement measures such that the software's factory settings only perform processing activities necessary for the purpose of processing.
- At the first instance of communication in case personal data are used to communicate with the data subject, the privacy policy must be presented to them.
- After the information is provided, the phone call should continue only if the data subjects give their explicit consent.
Assessment
The Authority underlined in the Public Announcement that the use of a pseudonym does not anonymise personal data. Additionally, the criterion of directly identifying the data subject is not adequate for personal data processing activity; a personal data processing activity will also be relevant when the data subject is identifiable. For instance, if a research company collects information such as the place of residence and economic characteristics of the data subject without identifying information details like the name and surname of the data subject, this data still constitutes personal data processing, as it can be linked to identifiable individuals.
Another important point from the Public Announcement is that the legal requirement for explicit consent aligns with the Authority's Principle Decision, which states that the processing of personal data by research companies only for the purpose of profit or economic benefit is inadequate for assessing legitimate interest. However, to the extent necessary for the research, explicit consent will not be required for the processing of information such as the date and duration of the call of the data subjects, the caller number and the traffic log in the form of the number called, which may be based on the legitimate interest of the data controller.
Conclusion
The decisions of the Authority must be complied with. In this context, data controllers should analyse the effects of the Public Announcement on their personal data processing processes.
You can access the full Public Announcement here.3
Footnotes
1. https://www.kvkk.gov.tr/Icerik/5434/2019-78
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
