Regulations Accepted within the Scope of the Law on Protection of Personal Data 19 July 2017
The Law on the Protection of Personal Data numbered 6698 (“the Law”) was accepted on24.03.2016 and came into force by its promulgation in the Official Gazette dated 07.04.2016 and numbered 29677. Within the scope of the Law, principles during personal data process are prescribed and additionally administrative and criminal sanctions are determined for the data controllers in case of a breach of the Law.
I. The Obligations of The Data Controller on Processing of Personal
a. Processing of Personal Data
Personal Data is defined by the Law as ”all the information relating to an identified or identifiable natural person”. Consequently, all personal information of a natural person such as name, surname, credentials, profile, photograph, address, phone number, closed circuit camera footage, voice records sets an example. The personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic data are deemed to be personal data of special nature and are subjected to more strict protection within the scope of the Law.
All operations performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means are considered as processing personal data.
b. The Data Controller
‘The data controller’, the natural or legal person who is responsible for determining the purposes and the means of processing, establishing and managing the data registry system, is under the obligation of informing data subject. Accordingly, , the data controller is obliged to inform data subject about the identity of himself and his representatives, if any, the purpose of data processing, to whom and with what purpose data shall be transferred, the method of collecting data and the legal reason of process and rights of the data subject which are stated by the Law. In addition, the data controller has some obligations regards the safety of data. Within this scope, the data controller is obliged to take required measures in order to prevent unlawful processing of and unlawful access to personal data and ensure the retention of personal data. The data controller is also responsible for rendering those who process data on their behalf to take required measures. Furthermore, the data controller is responsible in terms of conducting inspections or having inspections conducted to see whether required measures are taken, assuring that collected data shall not be declared in breach of law and shall not be used for personal interests. Moreover, the data controller must register in Data Controllers Registry.
II. Sanctions to be Applied in Case of Breach of Law
If the data controller does not fulfill his obligations mentioned above, several administrative and criminal sanctions prescribed in the Law shall be applied.. Accordingly, one year to for year in prison shall be applied in terms of crimes regarding personal data pursuant to Articles 135-140 of Turkish Criminal Code.
Additionally; actions considered as misdemeanor and penalties to be applied for them are stated in Article 18 of the Law. Within this scope, administrative fine ranging between 5.000 TL and 1.000.000 TL considering the characteristic of the obligation shall be imposed upon those who commit actions against law.
III. Conclusion
Analyzing who is the data controller, the obligations of being data controller and bringing data recording system in compliance with provisions of the legislation have importance in order to avoid being imposed upon heavy prison sentences and administrative fines prescribed by the Law and Turkish Criminal Code. Therefore, it is very important for the parties to have legal support from professionals who have extensive expertise in the Law on Protection of Personal Data and relevant legislation.
Türkçe Versiyonu İçin
