KVKK fines internet provider over in-flight data consent

The Personal Data Protection Authority (KVKK) has imposed an administrative fine of 90,000 TL on an internet service provider for violating data privacy laws during flights. The penalty follows a complaint from a passenger who was forced to provide explicit consent for the processing of personal data as a condition for accessing in-flight Wi-Fi.

Upon investigation, the KVKK determined that the service provider, rather than the airline, was the responsible party for the data processing practices. The authority ruled that making the provision of a service conditional upon obtaining explicit consent is unlawful under Law No. 6698. The decision emphasized that the provider's practice violated the principles of lawfulness and honesty, noting that other legal grounds for data processing exist beyond explicit consent.