Conditions For Processing Of Personal Data Of Special Nature 20 December 2019
Conditions For Processing Of Personal Data Of Special Nature
- Personal Data of Special Nature (Sensitive Data)
Personal data is all the information relating to an identified or identifiable natural person. Personal data of special nature is different and privileged than other personal data since it can be subject to victimization and discrimination therefore it is needed strict protection.
Personal data of special nature is stipulated in Law on the Protectıon of Personal Data numbered 6698 (“Law”) in limited cases. Except for those listed in the Law, cannot be considered as personal data of special nature. According to Article 6 of the Law, personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic data are deemed to be personal data of special nature.
This data may be processed with the explicit consent of the data subject concerned or in limited cases as specified in the Law.
- Processing of Personal Data of Special Nature and Processing Conditions
Article 5 of the Law regulates the conditions for processing personal data. The Law attaches special importance to personal data of a special nature and sets the conditions for the processing of such data in accordance with Article 6 of the Law. Personal data of special nature may only be processed if the data subject has explicit consent, or if it is explicitly required by law to treat Personal Data except for sexual life and personal health data. As will be understood, as a rule, processing of personal data of a special nature without the explicit consent of the data subject is prohibited. However, there is an exception on this subject, the Law made a distinction between the personal data and personal data of special nature. It is stipulated that adequate measures determined by Personal Data Protection Board (“Board”) are need to be taken while processing the personal data of special nature.
Accordingly, in the following cases it is possible to process personal data of special nature without taking explicit consent of data subject:
- Personal data, excluding those relating to health and sexual life may be processed without seeking explicit consent of the data subject, in the cases provided for by laws.
- Personal data relating to health and sexual life may only be processed, without seeking explicit consent of the data subject, by any person or authorized public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.
When adequate measures are taken, personal data relating to health and sexual life may also be shared, without seeking explicit consent of the data subject, by any person or authorized public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.
In areas where personal data of special nature are processed, the purposes of data processing should be presented in more detail than other fields. For example, the purpose of processing personal data of a special nature refers to a general purpose of personal data processing, such as carrying out human resources activities, does not provide sufficient detail at this point.
Processing of personal data of special nature in order to create a personal file for an employee, sets out the purpose of personal data processing in a more detailed and specific manner.
- The Rights of Data Subject
According to Article 11 of the Law, each person has the right to apply to the controller and to learn whether his personal data are processed or not, to request information if his personal data are processed, to learn the purpose of his data processing and whether this data is used for intended purposes, to know the third parties to whom his personal data is transferred at home or abroad, to request the rectification of the incomplete or inaccurate data, to request the erasure or destruction of his personal data, to request notification of the operations carried out with third parties to whom his personal data has been transferred, to object to the processing, exclusively by automatic means of his personal data, which leads to an unfavorable consequence for the data subject and to request compensation for the damage arising from the unlawful processing of his personal data.
- Application to the Controller:
It is mandatory for the data subjects to contact to the controller before exercising their rights. A complaint cannot be filed before exhausting the remedy of application to the controller. As it is obligatory to apply to the controller and complaint to the Board is optional, it will be possible for the data subjects whose application is implicitly or explicitly rejected to make a complaint to the Board and refer directly to the judiciary on the other hand. It should be stated that the obligation to directly contact the controller is a requirement that must be followed before the issue is transmitted to the Board. There is no obligation to apply to the controller before the matter is referred to the judiciary.
- Complaint to the Board:
The data subject may file a complaint with the Board if the application is declined, the response is found unsatisfactory or the response is not given in due time, within thirty days as of he learns about the response of the controller, or within sixty days as of the application date, in any case. A complaint cannot be filed before exhausting the remedy of application to the controller. It will be possible for the data subjects whose application is implicitly or explicitly rejected to make a complaint to the Board and refer directly to the judiciary on the other hand. The Board shall make the necessary examination in the matters falling within its scope of complaint and finalise it and give an answer to data subjects. In case the Board fails to answer the data subject’s application in sixty days as of the application date, it is deemed rejected. Accordingly, after the sixty-day period has elapsed from the date of the complaint, time for filing a lawsuit in administrative jurisdiction will begin.
Türkçe Versiyonu İçin: http://www.kasaroglu.av.tr/tr/40427/Ozel-Nitelikli-Kisisel-Verilerin-Korunma-Sartlari
