KVKK Fine Decision: 1 Million TRY Penalty on Savings Finance Company Sparks Digital Identity and Data Security Debate

Lawyer Ahmet Şahin from Kayseri filed a complaint with the Personal Data Protection Authority (KVKK) after receiving marketing SMS messages on his mobile phone without his explicit consent or knowledge. The company claimed that the phone number might have been added to the system by another customer, but the KVKK ruled that collecting personal data through third parties without the data subject's consent constitutes a violation, imposing a 1 million TRY administrative fine.

KVKK Ruling and Corporate Liability

■Marketing SMS messages were sent under a program conducted by the company last year, followed by voice calls.

■While the company argued that the phone number could have been entered into the system by another customer, the KVKK still classified the case as a lack of explicit consent.

■Following the fine, the company stated that Şahin's data had been permanently deleted and blocked from SMS panels.

Digital Identity and Data Security Risk Assessment

■Ahmet Şahin emphasized that personal data such as ID numbers, phone numbers, and IBANs form part of one's "digital identity".

■He warned that personal data can be sold, transferred abroad, and shared with other companies, stating, "This is actually a threat to us."

■The KVKK Board referred to the Electronic Commerce Law and the Message Management System (IYS) regulations, clearly stating that sending commercial electronic messages without consent is unlawful.

Analysis by Rüzgar Ersoy: As digital transformation accelerates in financial services, data security risks are escalating accordingly. Decisions like this from KVKK serve as a crucial benchmark for data processing protocols, especially for fintech companies. The emphasis placed on "consent management" by firms directly impacts investor confidence. Such incidents necessitate a re-evaluation of digital ethics standards across the sector.