What happens if GDPR compliance information is not provided for photo and video shoots at a beauty salon?
1. Introduction
Beauty salons sometimes record and share photos and videos of people receiving services to improve customer satisfaction and for advertising purposes. However, this creates serious obligations under the Law No. 6698 on the Protection of Personal Data (KVKK). This is because, according to the law, images of individuals constitute personal data.
This article will discuss the consequences of not using appropriate lighting in accordance with the Personal Data Protection Law (KVKK) during photo and video shoots in beauty salons, the rights of consumers, the responsibility of the salon owner, and a legal assessment based on a fictional case.
2. Personal Data and Image Recording
2.1. What is Personal Data?
According to Article 3 of the KVKK (Law on Protection of Personal Data), any information relating to an identified or identifiable natural person is considered personal data.
-
Photograph,
-
Video recording,
-
Audio recordings
are considered personal data.
2.2. Whether the Images Constitute Special Category Data
If the images clearly reveal a person's health condition or cosmetic procedure, these images may be considered "special categories of personal data." In this case, protection is much stricter.
3. Data Protection Law (KVKK) Disclosure Obligation
3.1. What is the Obligation to Provide Information?
Beauty salons, as data controllers, are obligated to inform individuals when collecting data. This information should include the following:
-
Identity of the data controller,
-
The purpose of the process is,
-
Individuals and organizations to whom the information will be transferred,
-
The summation method,
-
The rights of the individual.
3.2. What Happens If There Is No Lighting?
If personal data is processed without being informed:
-
This constitutes a violation of the Personal Data Protection Law (KVKK)
-
Administrative fines may be imposed
-
The individual may claim compensation for both material and moral damages.
4. Lawful Data Processing Conditions
According to Articles 5 and 6 of the KVKK (Law on Protection of Personal Data), personal data includes:
-
With explicit consent,
-
As required by law,
-
for the purpose of establishing and performing the contract
.
Sharing photos and videos for advertising purposes in beauty salons is not permitted without explicit consent.
5. Fictional Event
Incident:
“Consumer A” received a skin care service at “Beauty Center B”. During the procedure, employees took a photo of Consumer A and shared it on social media. No written or verbal consent was obtained from Consumer A, and no information notice was provided in accordance with the Personal Data Protection Law (KVKK).
Legal Assessment:
-
The images constitute personal data.
-
Data processing is unlawful because explicit consent was not obtained.
-
Consumer A can file a complaint with the Personal Data Protection Authority (KVKK) regarding the salon.
-
They can also claim compensation for emotional distress.
Result:
Beauty Center B faces both an administrative fine and the risk of compensation claims.
6. Consumer Rights
According to Article 11 of the Personal Data Protection Law (KVKK), consumers have the following rights:
-
To find out whether your personal data is being processed,
-
To understand the purpose of processing,
-
Requesting correction of incorrectly processed data,
-
Requesting the deletion or destruction of any unlawful processing
-
Claim compensation in case of damage.
7. Operator's Responsibility
7.1. Administrative Responsibility
The Personal Data Protection Board may impose administrative fines on operators who process data in violation of the KVKK (Personal Data Protection Law).
7.2. Legal Responsibility
The consumer can file a lawsuit for compensation for the emotional distress suffered.
7.3. Loss of Reputation
The GDPR violations that come to light seriously damage the commercial reputation of beauty centers.
8. Problems Encountered in Practice
-
The misconception that verbal consent is sufficient → However, according to the Personal Data Protection Law (KVKK), explicit consent must be in writing, specific, and informed.
-
Lack of any information provided → Most businesses film without informing the consumer.
-
Social media sharing → When posts go viral, they reach large audiences without the consumer's consent.
-
Perception of tacit consent in exchange for service → A customer receiving a service does not automatically mean they consent to image sharing.
9. Proposed Solutions
-
For businesses: Data protection notices compliant with the Personal Data Protection Law (KVKK) must be prepared, and written consent must be obtained from customers.
-
For consumers: Objections should be raised against taking pictures without proper lighting, and if necessary, a complaint should be filed with the Personal Data Protection Board.
-
From the state's perspective: Inspections regarding the implementation of the Personal Data Protection Law should be increased.
-
For industry associations: Standard GDPR forms should be prepared for beauty salons.
10. Conclusion
Taking photographs or videos in beauty salons is a personal data processing activity subject to the Turkish Personal Data Protection Law (KVKK). Any recording made without obtaining explicit consent and providing proper information is unlawful.
In such a situation:
-
The business faces administrative fines
-
The consumer can claim compensation
-
The company's brand reputation will be damaged.
In conclusion, the most appropriate approach for beauty salons is to obtain written consent and provide information in accordance with the Personal Data Protection Law (KVKK).
Gamze Akbulut, Law Faculty Student
About Post Author
