Legal AlertNewsPersonal Data Protection Board Rendered a Decision on the Issuing an Inadvertent Invoice to on Behalf of the Data Subject by the Data Controller Courier Company

Pursuant to the Decision, although the data subject have not been provided any services from the data controller, an invoice has sent to her/his e-mail address by the data controller courier company. In query made with the cargo shipping code, it was understood that the invoice belongs to the cargo transaction which is delivered to a company and the name, surname, address, e-mail address, identification number included in the invoice are transferred to the company which made the purchase. It was stated to the data subject that she/he applied to the data controller regarding the issue and in the answer, it was stated that the invoicing process is inadvertently made on behalf of the data subject and data was in the archives of the companies within the scope of the agreement signed between a public institution professional organization and the data controller, which enables members of the relevant professional organization to benefit from discounted shipping fees. Data subject has applied to Personal Data Protection Authority (‘’Authority’’) on the grounds that the personal data was processed by the data controller without relying on any of the legal processing requirements and the request for the deletion of the personal data of the data subject was not fulfilled by the data controller. 

As a result of the complaint, the Board made the following evaluations,

• The data controller processes the personal data of the data subject within the scope of legal basis for data processing; therefore, the personal data has not been processed unlawfully,
• It is lawful to process the personal data of the data subject regarding the transactions within the organization of the data controller carried out as sender or receiver, however, to issue an invoice to data subject for service which is not purchased is an unlawful data processing activity,
• It is compliant with the Law for the data controller to keep the personal data of the data subject for the periods specified in the law.

In the light of its evaluations, the Board decided, to impose an administrative fine on the data controller due to processing of personal data by issuing invoices to the data subject without any legal basis; since the data controller is required to keep the processed personal data for certain periods in accordance with the relevant legislation, there is no illegality in not fulfilling the request for the deletion of the personal data of the data subject.

You may reach the full Turkish version of the Decision via the link below.

https://www.kvkk.gov.tr/Icerik/7144/2021-993