News

29.04.2023

Guiding Decision of the Personal Data Protection Board on Loyalty Programs

The Turkish Personal Data Protection Authority (“PDPA”) has published summaries of 11 new Board decisions. One of these summaries is related to loyalty programs about which the PDPA has published a new draft guidelines in June 2022. With the publication of the relevant decision following the draft guidelines, the issues regarding loyalty programs have started to be clarified. The summary of the Board decision was published on the PDPA’s website on 18 July 2022 and is available online in Turkish here.

 

Background 

A notice was sent to the PDPA by the data subject, stating that; 

  • A special discount was applied to the loyalty card for some products sold in the store of the data controller, thus special discounts were made conditional, 

  • The personal data of the customer is requested for membership for the loyalty program and obtaining a card and, 

  • Explicit consent is imposed as a condition.

PDPA’s Evaluation

The PDPA has determined that the actual price of the product (99,99 TL) was reduced to 79,99 TL within the scope of a loyalty card special discount.

The opportunity to shop from the stores of the data controller for the data subjects who do not want to be included in the loyalty card program and/or who do not want to give their explicit consent within the scope of the program has not been removed, and the customers who are not members of the loyalty program may continue to shop at non-discounted prices.

In conclusion, the PDPA has determined that offering products/services at a discounted price with additional benefits within the scope of the loyalty program does not mean that explicit consent is imposed as a condition and decided that there is no violation of the Personal Data Protection Law.

Conclusion

The requirement that the products/services should not be subject to explicit consent as a rule will also remain valid in the case of personal data processing activities in the context of loyalty programs. However, in the presence of certain conditions, the request of the data controller for data subject to give explicit consent to the processing of data in order to benefit from the loyalty program may not be considered as a condition of explicit consent and may be considered to be in compliance with the law.

It is clear that this decision is in line with the Board's previous case-law on mandatory explicit consent for loyalty programs and with the published draft guide. However, the PDPA, in draft guidelines, considered that the discount/advantage ratio should not create a significant disadvantage for data subjects. Otherwise, the service could be considered conditional on consent.

As a result, if there is a special discount applied to the loyalty card by the data controller and the customer's personal data is requested for membership and card supply to the loyalty program, this does not mean that explicit consent is imposed as a condition. However, data controllers should also consider whether the benefit offered creates a significant disadvantage for a data subject.