What are the General Principles and Related Decisions in Accordance with the Law on Protection of Personal Data? 24 October 2019

Pursuant to Personal Data Protection Law No. 6698 (“Law”), the Personal Data Protection Board (“Board”) may examine violations in two ways. The first way is the investigation upon the complaint of the data subject; whereas, the second way is when the Board learns about the alleged violation, it shall examine the matters falling within the scope of its official duty.

When conducting the review, the Board first assesses the way that personal data is processed. Article 4 of the Law sets out the procedures and principles to be followed when processing personal data:

• Compliance with the Law and good faith.
• Accurate and up-to-date when necessary.
• Processed for specific, clear and legitimate purposes.
• Being relevant, limited and restrained to the purpose of processing
• Retained for the period required by the relevant legislation or for the purpose of processing.

In case of processing data contrary to the aforementioned principles, the data subject may request information from the data controller. If the data subject finds the answer insufficient or does not receive a response within the time period of thirty days; he can file a complaint to the Board within thirty days from the date of learning the response by data controller and in any case within sixty days from the date of filing the complaint. Data subjects whose personal rights are violated have the right to compensation under the general provisions.

As of Article 15 of the Law, the Board shall act ex officio upon complaint or upon learning of the alleged violation. In case of an existence of violation which is detected as a result of the examination, the Board decides the data controller to rectify these irregularities and notifies the relevant parties. This requirement shall be fulfilled within thirty days after the notification. If the violation is common/widespread, the Board makes a principle decision on this matter and publishes it.

Some of the Board's decisions regarding common/widespread cases where the general principles have been violated are as follows:

1. Pursuant to the Board's decision dated 01.07.2019 and numbered 2019/188, upon the publication of the exams results in the form of personal data of the related students on university website, the Board has decided that sharing the results in the form of an announcement that is open to the access of third parties is contrary to privacy-oriented approach of the Law, even if the university education has been completed and years have passed,

Article 4 of the Law has been violated on the basis of being relevant, limited and restrained to the purpose of data processing. For this reason, it was decided to apply disciplinary provisions about the university officials in accordance with paragraph 3 of Article 18, and to instruct the University to use an announcement system in which only the students access their own exam results.

2. Within the decision of the Board dated 20.04.2018, the request of a document containing the data for the transaction carried out by the data controller, but the transaction does not require, was considered to be contrary to Article 4 of the Law provisioning good faith and the principle of processing data for specific, clear and legitimate purposes because the requirement of such a document was not included within the Law and does not comply with its purpose.

Pursuant to Article 18 (b) of the Law, the Board has decided to impose an administrative fine on the data controller who does not take necessary technical and administrative measures to ensure the security of personal data in accordance with the first paragraph of Article 12 of the Law.

3. Within the decision of the Board on the same date, while receiving the explicit consent of the data subject for the processing of personal data of the contract parties; it is accepted that imposing explicit consent as a condition of membership and thus of the contract, as well as misleading the data subject when obtaining consent, will mean an abuse of the right by the data controller.

In addition, considering the fact that linking service to the explicit consent will disrupt explicit consent, this situation constitutes a contradiction with the law, good faith and the principle of being relevant, limited and restrained to the purpose of processing. Therefore, as of Article 18 (b) of the Law, it was decided to impose administrative sanctions on the data controller who did not fulfil the obligation to take the necessary technical and administrative measures to ensure data security in accordance with Article 12 of the Law.