The Personal Data Protection Authority’s New Resolution

The Personal Data Protection Authority (“Authority”) published its resolution dated 22.12.2020 and numbered 2020/966 (“Resolution”) in the Official Gazette dated 15.01.2021 and numbered 31365. In the Resolution, data controllers are warned to confirm the accuracy of data subjects’ contact information.

In the Resolution, it is determined that the documents containing personal data such as invoices, statements, reservation confirmation have been conveyed to irrelative third parties by the data controllers operating in different sectors such as e-commerce, telecommunication, transportation, tourism, due to data subjects’ false declaration. The Authority, reminding that the data controller has active due diligence in keeping personal data accurate and up-to-date, emphasized that the data controller should take all administrative and technical measures to prevent unlawful data processing.

In this context, the Authority decided that data controllers should take reasonable measures to confirm the accuracy of data subjects’ contact information. Sending a verification code / link to the phone number and / or e-mail address of the data subject was presented as an example of the measures confirming the accuracy of personal data.

You may access the full text of the Resolution here.