Turkiye: Opened consultation on Guideline regarding data protection in loyalty programmes

On 16 June 2022, the Turkish Personal Data Protection Authority (KVKK) opened a public consultation on the Draft Guideline on the Processing of Personal Data in Loyalty Programs until 16 July 2022. The guideline covers the processing of personal data in customer loyalty programmes, in which operators are qualified as data controllers, and customers as data subjects. The guideline differentiates the categories of personal data processed in loyalty programmes, providing a detailed list in the annex. In addition, the guideline explains that data processing activities that go beyond the purpose of the loyalty agreement can result in data protection violations. Specifically, if operators process data to provide personalised offers to customers or engage in profiling, the loyalty programme contract may not be a sufficient legal basis.