As a result of the evaluation of the complaints and notices submitted to the Personal Data Protection Authority regarding the websites and applications offering directory services, such as searching for names by phone number or vice versa, without obtaining explicit consent of the data subjects, which is contrary to Personal Data Protection Law No 6698 (the Law); it is found that there are numerous applications and websites that share personal data collected through several applications, websites or social media accounts and also provide services on reaching out to phone number by searching by name or vice versa.

Article 3(1)(e) of the Law stipulates that “any operation which is performed on personal data, wholly or partially by automated means or non-automated means which provided that form part of a data filing system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof, is processing of personal data” and to carry out any of these activities, one of the conditions under Article 5 and Article 6 of the Law must be in place, and also other requirements under the Law must be fulfilled.

Within this scope; the Board unanimously decides that;

• All data processing activities carried out by websites and mobile applications that share the contact information of the data subjects without being based on the Law and relevant legislation must be ceased immediately pursuant to Article 15(7) of the Law,
• In case it is found out the websites/applications in question have not ceased such activities, an application will be filed to the authorized institutions to ensure that necessary action is taken in order to prevent access to these websites/applications. Besides, considering the fact that the personal data might have been obtained unlawfully, the Chief Public Prosecutor’s Office will be notified in accordance with Article 158 of the Code of Criminal Procedure for the necessary legal actions to be taken regarding the relevant websites/applications, pursuant to Article 136 of the Turkish Penal Code No. 5237 entitled " Unlawful Sharing or Obtaining of Personal Data".

Respectfully announced to the public.