A Public Announcement on Personal Data Processing Activities of Research Companies by Dialing Random Numbers was published

On 26.08.2024, the Personal Data Protection Authority (Authority) published a Public Announcement on “Personal Data Processing Activities of Research Companies Using ‘Random Number Dialing and Telephone Interview Method’ for Statistical Research” (Announcement).

The significant points in the Announcement are briefly summarized below:

• Firstly, the Authority emphasizes that the processing of personal data for official statistical purposes or for purposes such as research, planning and statistics upon anonymization is within the scope of the exceptional cases to which the Law No. 6698 on the Protection of Personal Data (Law) will not apply.
• In the incident subject to the complaints, research companies randomly generate phone numbers and make survey calls to these numbers. During these calls, the explicit consent of the data subject is requested and if the data subject does not give explicit consent, the call is terminated. Upon termination of the call, the number in question is recorded in the do-not-call list, never to be called again. Moreover, personal data such as the voice recording of the call, the traffic log and the phone number of the data subject are processed and stored for 2 years using the pseudonymization method.
• The Authority considers that personal data processing activities carried out without anonymization in research processes must comply with the Law and that such activities will not be covered by the exception mentioned above.
• In addition, the Authority states that such personal data processing activities may be deemed lawful pursuant to Article 5/2 (f) of the Law (data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject) if they are carried out for the purposes of quality control of the research, fulfillment of the obligations of the researcher and proving the fulfillment of the obligations in case of a legal dispute.
• The Authority further emphasizes, however, that in order for such processing to be lawful, a layered disclosure must be made to the data subjects and that the telephone call must then continue if the data subjects give their explicit consent.