Guideline on Cookies Applications Has Been Published

Small information files stored on internet browsers by visited websites are called cookies. While some types of cookies are absolutely necessary for the functioning of the website visited, some types of cookies can be used to store information such as language preference or location of website visitors.

The Draft Guideline on Cookies Applications(in Turkish) was published by the Turkish Personal Data Protection Authority ("Authority") and presented to the public. On June 20, 2022, the Guideline on Cookies Applications ("Guideline") has been published on the website of the Authority for both data processors and data controllers.

It has been stated that the Guide will also be valid for desktop and mobile websites or web applications and it is aimed to create a guiding document as practical advice for all data controllers who operate a website. The Guideline also includes recommendations regarding personal data processed through cookies within the scope of the Turkish Personal Data Protection Law ("Law").

In the Guideline, examinations are carried out regarding the types of cookies, and evaluations are made on whether cookies require explicit consent or not.

Within the scope of the Guideline and the Law, data controllers are recommended to consider the following criteria's when processing personal data through cookies:

• Criteria A: The use of the cookie only for the purpose pf providing communication over the electronic communication network.
• Criteria B: The use of cookies is strictly necessary for information society services that the subscriber or user explicitly requests to receive services.

The personal data processing conditions for cookies within the scope of Law are as follows;

• Explicit consent or,
• As a result of the evaluation made by the data controller regarding the personal data processing activity through cookies, it is necessary to consider the other data processing conditions listed in Articles 5 and/or 6 of the Law.

Within the scope of the application of the processing conditions in the 5th and/or 6th articles, if the personal data processing is based on one of the conditions other than the explicit consent in the Law, in this case, there is no need to obtain explicit consent from the data subject.

It is stated in the Guideline that the data controller should primarily evaluate whether the purpose of the personal data processing activity is based on one of the other processing conditions other than explicit consent and if this purpose does not met any of the conditions other than explicit consent in the Law, then the data processing activity should be based on the explicit consent of the data subject.

It is recommended in the Guideline that, in case of relying on the processing condition, "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" in subparagraph (f) of the second paragraph of Article 5 of the Law, considering the scope of Criteria A and B, it is recommended to evaluate the existence of the legitimate interest by conducting a balance test by comparing the fundamental rights and freedoms of the individual with the legitimate interest of the data controller.

You can find the relevant Guideline here (In Turkish).

Should you have any queries or need further details, please contact your customer representative.