Turkish Data Protection Authority (“Turkish DPA”) published a new principle decision today. In the decision it stated that data controllers operating in various sectors such as e-commerce, telecommunications, transportation, and tourism request contact information of data subjects such as e-mail addresses or phone numbers in order to send invoice or reservation documents to them. It was identified  by the Turkish DPA that data subjects shared contact information of third parties instead of their own and in that cases, data controllers transmit documents such as invoices and reservation documents to third parties instead of data subjects.

Turkish DPA emphasizes the obligation of data controllers to keep the personal data accurate and up-to-date and therefore they must ensure that appropriate technical and administrative measures are in place in relation to this matter. Accordingly, Turkish DPA decided in its decision that data controllers should apply necessary verification methods such as sending activation links via email, or sending SMS confirmation codes to the data subjects at the time when the contact information of data subjects is requested.

We would like to point out that in cases where information is received through the website or the mobile application (creating a membership, an order etc.), it will be required to take necessary measures for the verification of the information of data subjects as per the Turkish DPA’s recent decision.