What are the legal consequences of processing personal data without explicit consent?

Entrance

The processing of personal data is directly related to the fundamental rights and freedoms of individuals and is strictly regulated within the framework of the Law No. 6698 on the Protection of Personal Data (KVKK) and the European Union General Data Protection Regulation (GDPR). In this context, the concept of "explicit consent" represents a critical threshold in terms of the legality of data processing activities.

This article will explain what explicit consent is, when it is required, the legal, criminal, and administrative consequences of data processing without consent, using a sample scenario, and will address the risks for companies.

---

1. What is Explicit Consent?

In Article 3 of the KVKK (Turkish Personal Data Protection Law), explicit consent is defined as follows:

"Informed and freely given consent regarding a specific matter."

Elements of Explicit Consent:

• Specificity is key: Which data will be processed, for what purpose, and by whom?

• Informed participation: Has the person been informed?

• Free will: Is it given without coercion, deception, or imposition?

Example (Consensual Consent):

By checking the box that says "You can process my email address to keep me informed about campaigns" when registering on an e-commerce site, the user is giving their explicit consent.

---

2. In Which Cases Is Explicit Consent Required?

a) General Rule: Explicit Consent Required

According to Article 5/1 of the KVKK (Law on Protection of Personal Data), personal data can only be processed with the explicit consent of the data subject.

b) Exceptions (Cases where explicit consent is not required)

In the cases listed in Article 5/2 of the KVKK (Law on Protection of Personal Data), explicit consent is not required. Examples:

• Explicitly provided for in the laws

• It must be necessary for the formation or performance of a contract

• Fulfillment of legal obligation

• It has been made public by the person concerned themselves

• It must be necessary for the establishment, exercise or protection of a right

• Provided that it does not harm the fundamental rights and freedoms of the data subject, it is necessary for the legitimate interests of the data controller

These exceptions should be interpreted narrowly. Not every data processing operation can be justified by these exceptions.

---

3. Legal Consequences of Data Processing Without Explicit Consent

a) Administrative Sanctions

According to Article 18 of the Personal Data Protection Law (KVKK);

• Violation of the obligation to provide information: Administrative fine in Turkish Lira

• Data processing without explicit consent: Serious administrative penalties

• Failure to delete data that should be deleted: Penalties

For the year 2025, administrative fines imposed by the Personal Data Protection Authority (KVKK) can reach up to 1,000,000 TL.

b) Legal Responsibility

The data subject may file a lawsuit against a data controller who unlawfully processes their personal data:

• Monetary compensation

• Moral compensation

• Deletion and destruction of data

• Discontinuation of use

They can file a lawsuit with the Civil Court of First Instance with this request.

c) Criminal Liability

Although the Personal Data Protection Law (KVKK) does not directly contain penal provisions, those responsible for the unlawful recording, sharing, and failure to delete personal data may face imprisonment ranging from 1 to 4 years under Articles 135-140 of the Turkish Penal Code (TCK).

---

4. Fictional Case Study: Medika Beauty Center Inc.

Event Summary

Medika Beauty Center, operating in Istanbul, offers its clients the following services:

• Identity information

• Skin analysis photos

• Their allergy histories

• Their aesthetic backgrounds

They are collecting and also sharing "before/after" images on their social media account without obtaining explicit consent.

Discovery of the Breach

A client discovers that their face photo has been published on Instagram without their consent and files a complaint with the Turkish Personal Data Protection Authority (KVKK).

Audits and Findings

• No information text

• Consent forms are missing or incomplete

• The photos were shared before they were made public

• No data inventory has been created

Results

• 400,000 TL administrative fine

• In the lawsuit for moral damages filed by the client in question, 25,000 TL in compensation was awarded

• Corporate reputation is damaged

• Instagram account will be closed

---

5. Risk Management for Companies in Practice

a) Put the explicit consent process in writing

Separate boxes, signed forms, and two-factor digital approvals should be created for the data to be collected from each customer.

b) Update the Privacy Policy

Clear and concise information text should be used on the website, mobile application, and in physical locations.

c) Exercise extra care with sensitive data

If information such as health, sexual life, or biometric data is being processed, consent must be obtained more strictly, and the data retention period must be clearly defined.

d) Obtain Additional Consent for Social Media Use

Separate, explicit, and written consent must be obtained to share a person's data on a digital platform. Simply saying, "I already sent it on WhatsApp," is not sufficient.

---

6. Compliance Differences from a GDPR Perspective

Companies working with European-based customers also face additional obligations under GDPR:

---

7. Adaptation Strategies: What Should Organizations Do?

• Data mapping should be done

• Consent management systems should be established (especially in digital environments)

• Education and policy updates are needed

• Monitoring and recording systems must be activated

• A data controller and contact person must be appointed

---

8. Conclusion

Explicit consent is not merely a formality in the processing of personal data; it is a guarantee of an individual's constitutionally protected right to privacy. Companies processing data without obtaining explicit consent from individuals, under the guise of "customer experience" or for commercial reasons or database creation, can face severe legal penalties. Therefore, establishing a transparent and lawful data processing procedure is essential for both legal security and corporate sustainability, rather than processing data without explicit consent.

Gamze Akbulut, Law Faculty Student