The Explicit Consent Misconception in Municipalities: Must Public Institutions Always Obtain Consent?
One of the most frequent and error-prone issues in municipal KVKK practice is treating explicit consent as the “default legal basis”.
⏱️ Reading time: 10 min · 📁 Category: KVKK, Public Institutions & explicit consent
The Explicit Consent Misconception in Municipalities: Must Public Institutions Always Obtain Consent?
One of the most frequent and error-prone issues in municipal KVKK practice is
treating explicit consent as the “default legal basis”.
Many metropolitan and district municipalities routinely prepare explicit consent forms
for almost every processing activity, leading to serious legal
and operational compliance problems.
Yet the structure of Law No. 6698, the KVKK, is clear:
explicit consent is an exception, not a rule.
In public institutions in particular, most processing relies not on explicit consent,
but on other legal grounds listed in the law.
Where a statutory basis exists, explicit consent cannot be obtained; even if obtained, it is legally invalid. What does explicit consent mean?
Under the KVKK, explicit consent is consent
that relates to a specific matter, is informed and is freely given
. This definition has three essential elements:
- Specificity: The data and the purpose of processing must be clear
- Information: The duty to inform must be fulfilled in full
- Free will: Consent cannot be made a condition of receiving a service
The most common mistake in municipalities is that these three elements are not evaluated together.
When do public institutions not obtain explicit consent?
Most municipal data processing
relies on the legal grounds set out in Articles 5(2) and 6(3) of the KVKK.
Most municipal services are directly defined by law.
In services such as zoning, permits, the environment, social assistance, municipal policing and transport,
data processing results from a statutory obligation.
- Permit applications
- Zoning procedures
- Social assistance assessments
- Tax, levy and fee procedures
conflicts with the hierarchy of legal grounds. 2) Performing a public duty
Municipalities are data controllers that provide services through the exercise of public authority.
Processing in these activities relies on
the performance of a public duty as its legal basis.
- Complaint and request management
- Inspection and control activities
- Municipal police procedures
In these procedures, obtaining explicit consent
already undermines the data subject’s freedom of choice from the outset.
In lawsuits, enforcement proceedings and other legal proceedings involving municipalities,
data processing relies on this legal ground.
explicit consent is not sought.
- Requiring a standard explicit consent form for every service
- Collecting consent through an “approval form” when carrying out a statutory procedure
- Stopping a service when consent is withdrawn
- Combining consent and the privacy notice in the same document
If consent can be withdrawn, that procedure should not rely on consent. When is explicit consent Needed?
In municipalities, areas where explicit consent is really necessary are limited:
- Communication for promotional and marketing purposes
- Event, newsletter and campaign notifications
- Additional services with no legal basis
- Digital applications involving profiling or behavioral analysis
If consent is sought in these areas,
it must be separate, explicit and withdrawable in its design.
- The belief that “obtaining consent keeps us safe”
- Failure to analyse the legal basis
- Ignoring the distinction between public and private sectors
- Using standard templates without questioning them
used in the wrong context, it increases it. The Right Approach: What Should Municipalities Do?
- Analyse the legal basis for each processing activity
- Use explicit consent only where it is actually needed
- Separate privacy notices from consent
- Withdrawing consent should not affect the service
One major obstacle to municipal KVKK compliance
is treating explicit consent as a cure-all.
For public institutions, the foundations are
statutory duties, the public interest and proportionality as guiding principles.
Explicit consent obtained in the wrong context
makes municipalities
more vulnerable rather than safer.
Sources and related documents
These documents provide references for the methods and rules discussed in this article.