Do You Need a Privacy Notice When Collecting Reader Data?

Why is reader data outside the exemption?

The exemption in Article 28(1)(c) of KVKK applies where personal data are “processed for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression”. Recording a reader's email address in your newsletter list is not processing within the scope of freedom of expression; it is commercial and operational processing. The same goes for membership, comments, surveys, prize draws, contact forms and advertising measurement.

The whole of the Law therefore applies to these processing operations: the principles in Article 4, a processing condition under Article 5 or Article 6, the duty to inform in Article 10, the rights in Article 11, security under Article 12, application and complaint under Articles 13-15, VERBİS under Article 16 and the administrative fines in Article 18. We dealt with the two-layer structure of the exemption in detail in journalistic activity and the KVKK exemption.

The duty to inform in Article 10 — word for word

“The data controller's obligation to inform — ARTICLE 10- (1) During the obtaining of personal data, the data controller or the person authorised by it is obliged to inform data subjects about;”

• a) The identity of the data controller and of its representative, if any,
• b) The purpose for which the personal data will be processed,
• c) To whom and for what purpose the processed personal data may be transferred,
• ç) The method and legal ground of collecting the personal data,
• d) The other rights listed in Article 11.
• The controller is obliged to provide information on all of the above.

Two technical details of the article are missed on most sites. The first is timing: the information must be given during the obtaining of the data — an email sent after registration has been completed does not satisfy that requirement. The second is scope: all five headings are mandatory; a general sentence such as “your personal data are processed in accordance with the legislation” satisfies none of them.

The rights of the data subject in Article 11 — word for word

Article 10(1)(d) makes it mandatory to write the rights in Article 11 into the privacy notice as well. The article reads: “ARTICLE 11- (1) Everyone has the right, by applying to the data controller, in relation to themselves;”

• a) To learn whether personal data are being processed,
• b) To request information if personal data have been processed,
• c) To learn the purpose of processing the personal data and whether they are used in accordance with that purpose,
• ç) To know the third parties in the country or abroad to whom the personal data are transferred,
• d) To request rectification of the personal data where they have been processed incompletely or inaccurately,
• e) To request erasure or destruction of the personal data within the framework of the conditions laid down in Article 7,
• f) To request notification of the operations carried out pursuant to subparagraphs (d) and (e) to the third parties to whom the personal data have been transferred,
• g) To object to a result arising against the person themselves through analysis of the processed data exclusively by automated systems,
• ğ) To claim compensation for damage where the person suffers damage because of the unlawful processing of their personal data.
• These are the rights held by the data subject.

Write these nine subparagraphs into your notice in full, not in abbreviated form. Subparagraph (e) is the legal basis of the erasure requests that reach your site; subparagraph (ğ) is expressly excluded from the partial exemption in Article 28(2), which means it does not disappear in any case of exemption.

Application and response deadlines (Articles 13-15)

Article 13(1): “The data subject shall submit their requests relating to the implementation of this Law to the data controller in writing or by other methods to be determined by the Board.” Article 13(2): “The data controller shall conclude the requests contained in the application, depending on the nature of the request, as soon as possible and within thirty days at the latest, free of charge. However, if the operation entails an additional cost, the fee in the tariff determined by the Board may be charged.”

Article 13(3) sets the form of the reply: “The data controller shall accept the request or reject it, giving reasons, and shall notify its reply to the data subject in writing or electronically.” Silence is not an option; under Article 14(1) a failure to reply within the deadline opens the route of complaint to the Board directly.

The sanction for breaching the duty to inform

Article 18(1)(a) of KVKK: an administrative fine “from 5,000 Turkish lira to 100,000 Turkish lira” is imposed on “those who fail to comply with the obligation to inform provided for in Article 10”. Under Article 18(2) as amended by Law No. 7499 this fine is applied to the data controller; Article 18(3) determines the avenue of appeal as the administrative court.

A copy-ready privacy notice template

The template below is constructed so as to cover in full the five headings listed in Article 10. Fill in the dotted fields from your own inventory; do not invent them — every purpose and every recipient you declare must actually exist. You can find how to draw up the inventory in the checklist in the article on the VERBİS registration obligation.

[SITE NAME] PRIVACY NOTICE ON THE PROCESSING OF
PERSONAL DATA

Last updated: ../../20..

1. IDENTITY OF THE DATA CONTROLLER  (KVKK Art. 10(1)(a))
   Legal name        : ..........................................
   Address           : ..........................................
   Trade registry no : ..........................................
   MERSİS no         : ..........................................
   Registered e-mail : ..........................................
   E-mail            : kvkk@......................................
   Representative (if any): .....................................

2. PERSONAL DATA PROCESSED AND PURPOSES  (Art. 10(1)(b))

   a) Membership and subscription
      Data     : name and surname, e-mail, ....................
      Purposes : creating the account, providing the
                 subscription service, .......................

   b) E-newsletter
      Data     : e-mail address, consent record, date and time
                 of consent, IP address of consent
      Purposes : sending the newsletter, proving the consent record

   c) Reader comments
      Data     : display name, e-mail, IP address, date and time
      Purposes : publication of the comment, moderation,
                 the record-keeping obligation arising from law

   ç) Contact and tip-off forms
      Data     : name and surname, e-mail, telephone, message
      Purposes : answering the request, keeping a record

   d) Measurement and operation of the site
      Data     : IP address, session information, ............
      Purposes : running the site, security, ................

3. PARTIES TO WHOM DATA ARE TRANSFERRED AND THE PURPOSE
   OF TRANSFER  (Art. 10(1)(c))
   - Hosting / server provider        : ...................
     Purpose: storage of the data and operation of the site
   - E-mail delivery service          : ...................
     Purpose: sending newsletters and information messages
   - Measurement service              : ...................
     Purpose: producing site usage statistics
   - Competent public institutions and organisations
     Purpose: meeting requests for information and documents
              provided for in laws
   Transfer abroad: [YES / NO]  — if yes, recipient country: ....

4. METHOD AND LEGAL GROUND OF COLLECTION  (Art. 10(1)(ç))
   Method: Electronically, through the forms on the site,
           membership and subscription screens, the comment
           field, and cookies and similar technologies.

   Legal ground (tick separately for each activity):
   [ ] KVKK Art. 5(1)    — explicit consent
   [ ] KVKK Art. 5(2)(a) — expressly provided for in laws
   [ ] KVKK Art. 5(2)(c) — conclusion or performance of a contract
   [ ] KVKK Art. 5(2)(ç) — fulfilment of a legal obligation
   [ ] KVKK Art. 5(2)(d) — data made public by the data subject
   [ ] KVKK Art. 5(2)(e) — establishment, exercise, protection of a right
   [ ] KVKK Art. 5(2)(f) — legitimate interests of the data controller
   If special categories of data are processed, additionally:
   KVKK Art. 6(3)(..)

5. RIGHTS OF THE DATA SUBJECT  (Art. 10(1)(d), Art. 11)
   Everyone has the right, by applying to the data controller,
   in relation to themselves;
   a) To learn whether personal data are being processed,
   b) To request information if personal data have been processed,
   c) To learn the purpose of processing the personal data and
      whether they are used in accordance with that purpose,
   ç) To know the third parties in the country or abroad to
      whom the personal data are transferred,
   d) To request rectification of the personal data where they
      have been processed incompletely or inaccurately,
   e) To request erasure or destruction of the personal data
      within the framework of the conditions laid down in
      Article 7,
   f) To request notification of the operations carried out
      pursuant to subparagraphs (d) and (e) to the third
      parties to whom the personal data have been transferred,
   g) To object to a result arising against the person
      themselves through analysis of the processed data
      exclusively by automated systems,
   ğ) To claim compensation for damage where the person suffers
      damage because of the unlawful processing of their
      personal data.

6. HOW TO APPLY
   Requests may be submitted in writing to the address above or
   to the registered electronic mail address. Applications are
   concluded, depending on the nature of the request, as soon as
   possible and within THIRTY DAYS at the latest, free of charge
   (KVKK Art. 13(2)). If the operation entails an additional
   cost, the fee in the tariff determined by the Board may be
   charged.

7. RETENTION PERIODS
   Membership data      : for the duration of membership + ..... years
   Newsletter consent   : while the consent is valid + ..... years
   Comment data         : ................................
   Contact form         : ................................
   At the end of the period the data are erased, destroyed or
   anonymised in accordance with the retention and destruction
   policy.

Place the template on every form in a context-sensitive way: next to the newsletter box link only to the newsletter section, and on the membership form to the membership section. A single link pointing at one enormous document weakens the requirement in Article 10 to inform “during the obtaining” of the data.

Four common mistakes

• Confusing the privacy notice with a privacy policy. A privacy policy is a commercial undertaking; the privacy notice is a statutory document that must cover the five headings in Article 10. You may merge the two, but all five headings must remain distinguishable.
• Not writing the legal ground. Article 10(1)(ç) expressly says “the legal ground”. Without stating which subparagraph of Article 5 you rely on for which activity, the document is incomplete.
• Hiding the parties to whom data are transferred. Your hosting, email and measurement providers are recipients within the meaning of Article 10(1)(c); they have to be listed.
• Writing the document once and forgetting it. When a new form, a new provider or a new purpose is added, the document must be updated; otherwise the accuracy principle in Article 4(2)(b) is breached as well.

The privacy notice is only one part of your site's set of statutory documents. Plan it within a single page architecture together with the imprint requirement and the obligation to display contact information; if you send newsletters, separately design the prior consent requirement under Law No. 6563. For the flow to follow in the event of a leak, see the article on personal data breach notification.