380 NEWSLETTER 2021 v. Personal data have been made public by the data subject himself / herself; vi. Data processing is necessary for the establishment, exercise or protection of any right; vii. Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject. In accordance with Article 9 regulating the transfer of personal data abroad, personal data can be transferred abroad with the explicit consent of the data subject. As well, personal data may be transferred abroad without the explicit consent of the data subject upon the existence of one of the abovementioned legal grounds and i) if the country where personal data is to be transferred to one of the countries that have been announced as having adequate protection by the Personal Data Protection Board, or ii) if the country is not announced as having adequate protection, then upon the existence of commitment for adequate protection in writing by the data controllers and authorisation of the Personal Data Protection Board regarding the related transfer. As it can be understood from the points explained above, in most cases, the data subject must give explicit consent for the processing (including the transfer activity) activities to be performed. As is clearly regulated in Article 3/1 (a) of the PDPL, explicit consent refers to the consent that is declared i) with free will, ii) on a specific subject and iii) based on information. In addition to the aforementioned three validity conditions, in accordance with the Communiqué on the Procedures and Principles for Fulfilling the Obligation of Disclosure, which regulates the rules regarding explicit consent, the notice to be made, and the consent to be obtained regarding data processing, must be carried out separately. As well, in accordance with the established decisions and the published guidelines of the Personal Data Protection Board, binding the explicit consent to the condition of service means the impairment of free will, which is one of the basic validity conditions and, therefore, invalidates explicit consent.7 In addition, blanket 7 Personal Data Protection Board’s Decision, No. 2018/19, 16.02.2018, https://
RkJQdWJsaXNoZXIy MjUzNjE=