Explicit consent has been defined as consent that relates to a specified issue, declared by free will, and based on information.
The definition provides that not all kinds of consent will suffice under the Data Protection Law. The data subject must know for what s/he is giving consent and must clearly express his/her consent. For example, consent obtained in English from non-English speakers in Turkey would not be considered to be explicit consent. Further, implied consent is not regarded as lawful under the Data Protection Law. However, the Data Protection Law does not envisage any form required to obtain consent from data subjects. Therefore, there is no need to collect explicit consent in writing, but online mechanisms will also be sufficient.
The explicit consent necessitates informing data subjects of the identity of the data controller, the purpose of the data processing, the persons to whom the data will be transferred, and for which purposes, the method and legal grounds for the collection of personal data, as well as the rights of the data subject; therefore, consent mechanisms must be accompanied with information on data processing to be held valid.
Consent may be obtained for a specific purpose. A consent received for a vague or general purpose is not considered valid. It must be freely given; therefore, employee consent mechanisms must be handled diligently. Data subjects may withdraw their consent at any time during the data processing. Upon withdrawal of consent, data controllers cannot continue data processing in principle; however, exceptions to this principle exist exceptionally for specific sectors.
Aside from this, in the decisions concerning fitness centres, the DPA once again emphasised the requirement to comply with the principle of proportionality even in the presence of explicit consent and ruled that explicit consent will not be deemed valid legal grounds for data processing activities that are contrary to the principle of proportionality.