On August 14, 2023, the Personal Data Protection Authority (KVKK) published a summary of its decision No. 2023/692, as issued on May 2, 2023, in which it imposed a fine of TRY 300,000 (approx. $11,090) to an unnamed healthcare institution for violations of the Law on Protection of Personal Data (the Law), following a complaint by an individual.

Background to the decision

The KVKK acknowledged receiving a complaint from an individual alleging that, while completing an appointment scheduling form on the healthcare institution's website, applicants are compelled to provide consent for their data processing, to receive information about the institution's services and announcements, and for communication purposes. According to the complaint, failing to select the promotional consent box prevented the completion of the appointment process, effectively tying the service to the declaration of consent.

Findings of the KVKK

The KVKK observed that, on the appointment form page of the healthcare institution's website, personal data including name, surname, national ID number, birth date, and cell phone number were requested. Simultaneously, an option was provided for individuals to grant consent for using their personal information for services and announcements, visually highlighted in red when unselected, suggesting an error warning. 

It was ascertained that modifications had been made by the healthcare institution subsequent to the complaint date. Notably, the obligatory nature of consent for receiving announcements was eliminated, while an additional checkbox for explicit consent was introduced. The KVKK recognized that mandating explicit consent for promotional activities tied to the healthcare institution's services, within the healthcare service provision, limits the 'freely given' element of consent. Based on these findings, the KVKK determined that a breach of Article 12(1) of the Law had occurred.

Outcomes

For the reasons stated above, the KVKK imposed a fine of TRY 300,000 (approx. $11,090) on the healthcare institution for violation of Article 12(1) of the Law.

You can read the decision, only available in Turkish, here.