According to the decision by the Personal Data Protection Authority (KVKK), a person who stayed at a hotel received a document via social media that included details about their hotel stay and personal information.
It was suggested that the document might have been leaked by hotel employees.
Believing that the document was leaked by hotel staff, the person claimed that the hotel, being the data controller, failed to fulfill its obligations and filed a complaint with the KVKK.
Under the Law on the Protection of Personal Data No. 6698, the authority investigated the complaint and determined that the shared information was produced within the hotel.
The authority decided to impose a fine of 500,000 lira on the hotel for not taking the necessary technical and administrative measures to prevent unlawful access to personal data and to ensure the protection of personal data.
EXPLICIT CONSENT REQUIRED FOR PROCESSING INFORMATION FOR ADVERTISING AND MARKETING PURPOSES
The KVKK’s decision noted that the obligation to fill out and sign the accommodation document does not imply consent to process individuals’ information for communication, advertising, and marketing purposes.
The decision stated that hotels need to obtain explicit consent for processing for advertising and marketing purposes and that this requirement should be included in the informative text provided to customers.
