When the company, as data creditor, aims to base its business model profitability on the processing of personal data, the obligation on the consumers’ part to provide their personal data is interconnected with other obligations under the contract. This interconnection raises the question of whether data processing for the purposes which are expressly provided under contractual requirements does not require the consent of the data subject.

By contrast, processing personal data for purposes which are not necessary for the provision of a service is only possible with the consent of the data subject, unless alternative legal grounds for processing are applicable which are independent of users’ authorization. Nevertheless, determining the threshold with regard to the processing personal data for the purposes which are necessary for the provision of a service, is highly controversial. Once the threshold is defined, the question that needs to be addressed is when the consent of the data subject can be considered to have been freely given, if the provision of the service is dependent on that consent.

Nafiye Yücedağ has been working since 2011 as a research assistant in the Civil Law chair of Istanbul University Faculty of Law.