Introduction
In today’s world, with the rapid pace of digitalization, e-commerce applications have shown significant development. During this process, the lawful processing of personal data and the protection of the rights of the individuals concerned have become of great importance. E-commerce platforms request various personal data from their users, and among these data, the Turkish Identification Number (TCKN) is included. The TCKN is a critical piece of personal data for identifying individuals and conducting official procedures, and its processing must comply with legal regulations. Many individuals also have concerns about sharing their TCKN in the digital environment. This article will discuss the usage areas of TCKN in e-commerce applications, its legal foundations, and its evaluation within the framework of relevant legislation.
Legal Status of Turkish Identification Number
Although the TCKN is not considered as “special categories of personal data” within the scope of the Law No. 6698 on the Protection of Personal Data (KVKK), it is in the category of “personal data” and is among the data that should be approached with special care during processing. As stated in the decision of the Personal Data Protection Authority dated August 17, 2023, and numbered 2023/1430, TCKN is a more important data compared to phone numbers, and in case of a data breach, it may lead to greater harm.
Under Turkish law, TCKN is used for identity verification and conducting official procedures. However, the processing of this data is not always mandatory. Especially during e-commerce activities, there are certain aspects that should be considered when processing TCKN.
Usage Areas of Turkish Identification Number in E-Commerce Platforms
Some examples of the purposes for processing TCKN on e-commerce platforms can be given as follows:
- Membership and Identity Verification: Some platforms may use TCKN for verification to ensure users perform transactions with their real identities.
- Invoice Issuance: Sellers who are required to issue invoices according to the Tax Procedure Law and related regulations may request the TCKN of individual customers.
- Installment Sales and Financial Transactions: In transactions with banks and financial institutions, TCKN is used for identity verification and financial security.
- Fraud and Forgery Prevention: Identity verification systems with TCKN are used to prevent fake accounts and to comply with legal regulations.
Processing of Turkish Identification Number in E-Commerce and Invoice Issuance
Article 230 of Tax Procedure Law No. 213 lists the mandatory information to be included in the invoice, including the customer’s name, trade name, address, tax office and account number, if any. However, the said article does not stipulate an obligation to include the Turkish ID number in the invoice. In the guidance published by the Personal Data Protection Authority, it is emphasized that there is no legal obligation to obtain or include the customer’s Turkish ID number in the invoices issued to final consumers who are not taxpayers.
On the other hand, in Article 232 of the Tax Procedure Law titled “Obligation to Use Invoices,” it is clarified who is obligated to issue and receive invoices. Accordingly, first and second-class merchants, freelance professionals, merchants taxed under the simple regime, farmers who are required to keep records, and those selling to tax-exempt tradespeople are obliged to issue invoices and also receive invoices. If the customer is a real person taxpayer, the TCKN, which has been associated with the tax identification number since July 1, 2006, must be included on the invoice. In addition, in accordance with the obligation of the party selling goods or services to notify the Republic of Turkey Ministry of Treasury and Finance through the “BS Form” within the framework of the Tax Procedure Law, if the transaction amount exceeds 5,000 TL in sales to final consumers, the sale in question will have to be notified and the customer’s T.R. Identification number must be included in this form. In such cases, in accordance with Article 5/2-a of the KVKK, it becomes possible to process personal data of the Turkish ID number type without obtaining explicit consent.
In situations other than the ones mentioned above, explicit consent from the data subject must be obtained for processing TCKN under the KVKK. However, even if explicit consent is obtained, the Personal Data Protection Authority may evaluate it in terms of the principle of proportionality.
Conclusion
In conclusion, the use of TCKN in e-commerce platforms plays a significant role in both the protection of personal data and compliance with legal regulations. TCKN is protected as “personal data” under the KVKK, and its processing and storage must be carried out in accordance with the law. It is clear that during e-commerce transactions, TCKN should only be processed within the scope of legal obligations or the data subject’s consent. In this context, it is crucial for all parties involved in the e-commerce sector to comply with legal regulations and take the necessary measures for the protection of personal data.
Aleyna Çeven
Attorney At Law