Personal Data Protection Board Decisions: Failure to Ensure Data Security 4 February 2020
In accordance with the Personal Data Protection Law (“PDPL”), various sanctions have been recently applied by the Personal Data Protection Board(“Board”) due to the violation of the PDPL, which establishes, administers and manages the personal data recording system and these sanctions were published on the Board’s website in the form of a board decision. When the relevant decisions are examined, it can be seen that the most common violations of the data controllers are the failure to fulfil the obligation to prevent the unlawful processing and access of the personal data and ensure the preservation of the personal data mentioned in Article 12 (1) of the law.
Board Decisions on Failure to Ensure Data Security within the Scope of Article 12(1) of the PDPL
- Contract samples which included the home address of the person responsible for the management of the process (data subject) on behalf of the company were sent to the employees of a company by e-mail by the data controller without relying on any of the personal data processing conditions listed in Article 5 of the Law. Therefore, it was decided for administrative sanctions to be applied to the data controller who could not ensure data security in accordance with Article 12.
- In the transaction carried out by the data controller with the request of the related person, request of a document containing personal data from the customer by data controller which was not included in the relevant legislation and for the data to not be compatible with the purpose aimed to be achieved in the Article 4 of the PDPL was in accordance with the principle of compliance with law and good faith and for legitimate purposes. Therefore, the Board decided to impose administrative sanctions on the data controller who had not taken the necessary technical and administrative measures to ensure the security of personal data in accordance with paragraph 1 of Article 12 of PDPL.
- The document containing the customer's personal data was sent to another person who had the same name with the customer by the data controller; pointing to a systemic vulnerability to the data controller, the Board has decided to impose administrative sanctions on the data controller who did not take the necessary technical and administrative measures to ensure data security in accordance with paragraph 1 of Article 12 of PDPL.
- Following the job application made by the data subject through a platform belonging to the data controller who provided online human resources service; it was determined that the data controller shared the personal data including the application information, name and surname and e-mail address of the person with other job applicants without any legal reason. In this case; because of the violation of Article 12 paragraph 1 of the PDPL, an administrative fine was imposed on the said company.
Türkçe versiyonu için:
