Anonymizing Personal Data 12 September 2017

I. Personal Data

Personal Data is defined by the Law on the Protection of Personal Data numbered 6698 (“the Law”) as ”all the information relating to an identified or identifiable natural person”. Accordingly, all personal information of a natural person such as name, surname, credentials, profile, photograph, address, phone number, closed circuit camera footage, voice records is exemplary.

II. Processing and Transferring Personal Data

All operations performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means are considered as processing personal data.

According to the Law, the main statute in processing personal data is presence of the consent of data subject. Hereunder, it is prohibited to process the personal data of special nature without explicit consent of the data subject. Exceptional cases determined by the Law are reserved.

III. Anonymizing Personal Data

In scope of the Law anonymization means “Rendering personal data cannot be linked to any identifiable or identified party even through matching data with other data”.

As explained above, the significant point in processing and transferring personal data is the possibility of data to be associated to any identified or identifiable party. Hence, on the condition that personal data is anonymized, the data shall not be subject to procedures and regulations stated by the Law.

Despite the fact that the Law does not state an article suggesting a precise method of anonymization, Paragraph 3 of Article 7 of the Law indicates that procedures and principles for the erasure, destruction or anonymizing of personal data shall be laid down through secondary regulation. Consequently there are no available regulations on the matter of anonymization, but the endeavors of Personal Data Protection Board are ongoing.

On the other hand, on the publications of Personal Data Protection Board there are frequently used methods of anonymization and these publications also state that if personal data is rendered not to be linked with identifiable or identifiable parties through these methods, the anonymization shall be valid. Some of these methods are masking, generating cumulative data, data derivation and shuffling data.

IV. Conclusion

We would like to emphasize that a certain evaluation cannot be made about that whether the anonymization by above-mentioned methods is valid or not. There is still possibility of data being associated to any identifiable or identified parties although any of the methods is chosen and applied to data. In such a situation, the anonymization shall not be valid. In addition, the administrative and criminal sanctions stated by the Law shall be imposed under such circumstance. Therefore; the matter of anonymization of data requires proficiency of experts.

Türkçe Versiyonu İçin

http://www.kasaroglu.av.tr/tr/31500/Kisisel-Verilerin-Anonim-Hale-Getirilmesi

Previous Next

Publications

This website and the information herein has been designed in accordance with the Professional Rules of the Union of the Turkish Bars Association and in particular the regulations prohibiting advertisement by attorneys at law. All material included in the Kasaroğlu Web Site is for informational purposes only and Kasaroğlu Law Office expressly disclaims all liability to any person in respect of anything and in respect of consequences of anything done in reliance upon the whole or any part of the contents of the Kasaroğlu Web site. Transmission of this information is not intended to create and receipt does not constitute an attorney-client relationship between Kasaroğlu and the user or browser. No client or other reader should act or not refrain from acting on the basis of any matter contained in the Kasaroğlu site without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue. Kasaroğlu is not responsible for any third party contents which can be accessed through the web site.

The solution partner of Kasaroglu Law Office which provides extensive services in the field of Merging & Acquisation is “Kasaroğlu Uluslararası Danışmanlık Hizmetleri A.Ş." with its significant expertise and experience in this area.