It has been determined that data controllers, operating in various sectors such as e-commerce, telecommunications, transportation, tourism etc., demand data subjects to declare their phone numbers and/or e-mail addresses in order to send documents containing personal data like invoice, receipts, booking documents via SMS and/or e-mail; however, it is seen that the data declared by the data subjects may be inaccurate, or the documents which contain information about data subjects are forwarded to third parties due to that data subjects declare information belonging to third parties.

As it is known, Article 4(1) of the Protection of Personal Data Law No. 6698 stipulates that “Personal data shall only be processed in compliance with procedures and principles laid down in this Law or other laws.” and in the second paragraph it is regulated that it is mandatory to comply with the principles “a) Lawfulness and fairness, b) Being accurate and kept up to date where necessary, c) Being processed for specified, explicit and legitimate purposes, ç) Being relevant, limited and proportionate to the purposes for which they are processed, d) Being stored for the period laid down by relevant legislation or the period required for the purpose for which the personal data are processed.”

Keeping personal data accurate and up-to-date, which is among these principles, when necessary, is in the interest of the data controller as well as necessary for the protection of the fundamental rights and freedoms of the data subject; therefore, the data controller must pay an active due diligence to ensure that the personal data is accurate and up-to-date when necessary, if it creates and has a consequence on the data subject. Apart from this, it is important that the data controller always keeps the channels open to ensure that the information of the data subject is accurate and up-to-date when necessary. Otherwise, individuals may suffer material and intangible damages due to outdated or inaccurate personal data. In this sense, in order to ensure that personal data are kept accurate and up-to-date when necessary; it is considered necessary to take reasonable measures for the verification of the contact information declared by the data subjects (sending a verification code/link to a telephone number and/or e-mail address, etc.) in order to determine the source from which the personal data is collected and to prevent negative consequences for the data subjects due to the inaccuracy of the personal data.

On the other hand, Article 12 of the Law stipulates that data controllers are obliged to take all necessary technical and organizational measures to provide an appropriate level of security for the purposes of a) preventing unlawful processing of personal data, b) preventing unlawful access to personal data, c) ensuring protection of personal data.

In this context; to prevent the unlawful sending of personal data belonging to third parties by data controllers to communication channels such as phone numbers and e-mail address of data subjects, which that violates the Personal Data Protection Law No. 6698, the Board unanimously decides that:

• Pursuant to Article 15(6) of the Law, a Resolution shall be adopted and published in the Official Gazette and on the Authority’s website, regarding that data controllers shall take necessary administrative and organizational measures to establish mechanisms that will confirm the accuracy of the contact information notified to themselves, as per Article 12 of the Law.