With the technological developments and increasing digitalization trends in the world, significant changes occur in marketing and sales methods as well as different digital tools have been started to be used in order to provide online sales opportunities with fast and high service quality on websites. Cookies, as one of these latest digital tools, have increased their place in e-commerce practice to ensure that the consumption habits of the buyers are closely monitored, so that personalized and special services are offered to the buyers. Cookies, that are attractive to be used by website operators, are defined as low-size and rich text-formatted instruments that allow certain information about users to be stored on their terminal devices when they visit the website.
Operators may use different types of cookies depending on their purposes on the website, as essential cookies, functional cookies, analytical cookies, tracking cookies and marketing cookies. The mandatory and functional cookies are necessary for the proper functioning of the website since they are served to fulfill an information society service requested by the user (such as logging in, filling out forms, remembering privacy preferences). On the other hand, advertising and marketing cookies are the most frequently used types of cookies by operators, which enable users to monitor their online movements on the internet and consequently determine their personal interests and display related advertisements to users.
The increasing use of cookies by website operators and the collection of various information of visitors through cookies, have made it obligatory to consider cookie activities in respect of data privacy. In most cases, personal data are collected indiscriminately via cookies on websites and these data are processed by operators and transferred to third parties for purposes such as advertising and marketing without the consent of the data subjects. Although cookies are regulated within the General Data Protection Regulation (GDPR) and the Directive 2002/58/EC (E-Privacy Directive), there is no specific legislation on cookies under Turkish Law. However, as cookies are regarded as one of the data collection instruments, the general provisions of the Law on the Protection of Personal Data No. 6698 ("Law"), which is the main law in the field of personal data protection in Turkey, and its secondary regulations on personal data processing are applied for use of cookies. Therefore, operators are obliged and expected to comply with the personal data protection legislation.
In accordance with Article 5 of the Law, personal data cannot be processed without the explicit consent of the data subject unless such processing activity falls within one of the legal bases stated under the same Article. While processing personal data, the purpose of the cookies plays an important role to determine whether there is any need to obtain the explicit consent of the data subject. Given that the mandatory and functional cookies are necessary for the functioning of the website, no explicit consent will be required to use such cookies to process data as this will fall within the legal base of ''performance of the contract'' or ''legitimate interest of the data controller''. On the other hand, the explicit consent of the data subject should be only way for the cookies used for advertising and marketing purposes as there is no legal base to process data. It would be worth mentioned that in any event the data subjects must be informed (privacy notice) in accordance with Article 10 of the Law regarding which types of cookies are collected on the website, for which purposes these cookies are processed, to whom and for what purposes they will be transferred and the legal rights of the data subjects for the use of cookies. In any case, it should be noted that cookies must only be stored for as long as they are necessary for the purposes of processing.
Practice Area News
The Personal Data Protection Board ("Board")'s decision dated 27 February 2020 on Amazon Turkey Perakende Hizmetleri Limited Şirketi ("Amazon") is the first document that is produced by the Board, sheds significant light on the Board's view on cookie practices in Turkey. According to the decision, the cookie settings on the websites must not be designed as opt-out, so that automatic consent is not valid since it is not based on the active and free will of the data subject and the visitors must be aware on how cookies be processed by the operators via cookie policy duly set out on the website. With this decision, the Board made it clear that it considers use of cookies as personal data processing method within the meaning of the Law, and that a cookie notice must be provided, and an explicit consent must be obtained, if required. The cookies that require explicit consent must be "marketing/tracking" cookies, and that the "mandatory/functionally cookies" can be used based on "legitimate interest and/or performance of the contract as legal basis" legal basis. Due to the fact that privacy notice of Amazon does not fulfil the information obligation related to cookies, the Board imposed an administrative fine of TRY 100,000 to Amazon.
The Personal Data Protection Authority ("Authority") has published in June 2022 a guideline on the use of the cookies ("Guideline"). After the decision given for Amazon, the Guideline plays an important role due to the absence of a specific legislation on cookies from the point of the cookie practice in Turkey. The purpose of the Guideline is to encourage the operators to take the necessary measures by considering the use of cookies' increasement in digital sectors. Within the Guideline, the Authority provides operators with good practice examples and expresses the administrative and technical measures that they can take for their websites such as the preparation of privacy notices for the purpose of informing the data subjects and designing of pop ups and/or checkboxes to obtain consent from data subjects in required cases. According to the Guideline, data controllers should understand what purposes cookies have and decide pursuant to their needs which cookies are used on their websites. Under the Guideline the Authority affirms that use of the cookies is a substantial personal data processing activity and thus the data subjects must always be informed through a privacy notice. As under the Guideline cookie data is listed one of the marketing data, the Authority further emphasizes the importance of the explicit consent to be obtained from the data subjects in accordance with Article 5.1 of the Law, if necessary.
As explained above, in Turkey there is no specific legislation on cookies, apart from the Amazon Decision and the Guideline. Due to lack of specific legislation on cookies, there are still uncertainties for the performance of the cookies. Considering that cookies are notable personal data processing tools and used on many websites today, we hope in the near future a specific legislation on cookies will be introduced.
Originally published by Legal Industry Review .
© Kolcuoğlu Demirkan Koçaklı Attorneys at Law 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
