Scope of the Data Controller’s Obligation to Inform 21 November 2019
Data Controller refers to the natural or legal person who determines the purpose and means of processing personal data and is responsible for establishing and managing the data registry system. Legal persons are themselves considered to be the data controller within the scope of their activities regarding the processing of personal data.
In accordance with the Article 10 of the Law on the Protection of Personal Data numbered 6698 (“Law”),the data controllers are obliged to inform the data subjects whose personal data are processed. The informing obligation which is a liability for the data controllers is also a right for natural persons whose personal data are processed. The informing obligation, which means giving information about the processed personal data, is an essential requirement for the lawful execution of personal data processing. In order to fulfill the obligation of informing, the persons whose personal data are processed must be informed at least as to the conditions listed in Article 10 of the Law. While fulfilling the informing obligation in question, Notice on the Procedures and Principles to be Followed for the Fulfillment of the Obligation of Informing (“Notice”)must be complied with.
The obligation to inform is not an obligation to the request of the person whose personal data is processed. Even if the person has explicit consent or other personal data processing requirements are met, the data controller shall fulfill the obligation to inform. This is because the obligation to inform is an obligation that must be fulfilled, regardless of the expressed consent or other personal data processing conditions in the Law.
- Obligation to Inform When Obtaining Personal Data From The Data Subjects
According to the law, the person in charge of the data or the person authorized by him should inform the data subject during the collection of personal data. According to Article 10, which includes the provisions regarding the obligation to inform, this information to be provided by the data controller or authorized person to the data subjects shall include at least the following conditions:
1.Identification of the data controller or its representative, if any,
The data officer and his/her representative, if any, should disclose his/her identity and contact information that can be easily contacted by different means. For example; the name of the legal person, the name and the surname of the natural person, the name / title of the representative of the data controller assigned by him, and the contact information such as phone number, e-mail address, internet address or postal address.
- The purpose of data processing
According to the first paragraph of Article 5 of the Notice; the purpose of the data processing should be specific, clear and legitimate when fulfilling the obligation to inform. Expressions of a general nature that are vague and that may form an opinion in data subjects' mind that their data can be processed for other purposes should be avoided in informing process.
- To whom and for what purposes the processed data may be transferred
According to Article 5 of the Notice, the purpose of the disclosure of personal data and the groups of recipients to be transferred should be clearly stated when fulfilling the obligation to inform by the data controller. The transfer of personal data both at home and abroad is regulated in articles 8 and 9 of the Law.The data controller shall comply with these provisions in the event that the personal data they are processing is transferred at home and abroad. These receiving parties may be business partners, suppliers, affiliates, shareholders, legally authorized public institutions and organizations, legally authorized private law persons, community companies and so on.
4.The method and legal reason of collection of personal data
According to Article 5 of the Notice; it must be clearly stated that personal data is processed on the basis of which of the personal data processing conditions listed in articles 5 and 6 of the Law. Again according to this article; it should also be clearly stated whether personal data is obtained in whole or in part by automatic means or by non-automatic methods provided that it is part of the data recording system.
The data controller shall decide on the method and means of data collection.
5.Other rights of the data subject referred to in Article 11
The data controller and his / her representative, if any, should inform the data subject that he / she also has the rights specified in Article 11 of the Law.
- Obligation To Inform In Cases Where the Personal Data Cannot be obtained from the Data Subject
In order to process personal data in accordance with the Law, personal data must first be obtained from the data subject concerned. However, Article 6 of the Notice regulates how to fulfill the obligation to inform if personal data is not directly obtained from the person concerned. According to this; if personal data cannot be obtained directly from the data subject due to the practical impossibility or lack of access to the subject;
- Within a reasonable period of time from the collection of personal data,
- If personal data will be used for communication with the data subject, during the initial communication,
- If the personal data is to be transferred, during at the latest when the personal data is transferred for the first time,
the obligation to inform the data subject must be fulfilled.
Türkçe Versiyonu İçin: http://www.kasaroglu.av.tr/tr/Veri-Sorumlularinin-Aydinlatma-Yukumluluklerinin-kapsami
