Remarkable Points within the Scope Of Regulation on Deletion, Destruction or Anonymization of Personal Data 22 November 2017

Law on Protection of Personal Data numbered 6698 (“the Law”) determined the general framework and stated that procedures and principles on many articles shall be regulated with regulations while protecting all kinds of data relating to identified or identifiable natural person.

The first regulation drafted within this scope is the Regulation on Deletion, Destruction or Anonymization of Personal Data (“the Regulation”) has been published in the Official Gazette dated 28.10.2017 and numbered 30224. The Regulation has been published in order to regulate the procedures and principles regarding the responsibility to delete, destruct or anonymize the personal data envisaged under the Article 7 of the Law upon the request of the related person or ex officio when the reasons requiring them to be processed disappear.

The Regulation firstly defines the acts of deletion, destruction and anonymization which it calls as extermination as a whole. Within this context, while deletion of personal data is to make it inaccessible and unusable in any ways for related users; destruction is making personal data inaccessible, unusable and nonreturnable in any ways and anonymization is to make personal data non-relatable to any identified or identifiable natural person in any ways even if it is matched up with other data. However, no explanation is made regarding usage of which techniques will be considered under this scope.

Responsibility of data controller related to exterminate the personal data, in other words delete, destruct or anonymize it, arises when the reason requiring it to be processed disappears. Data controller may choose one of these ways unless there is a decision of Board of Protection of Personal Data (“the Board”) on the contrary. Time to execute the extermination varies depending on whether it is being done upon the request of the related person or ex officio and if it is ex officio whether the data controller is obligated to register to the Data Controller Registry. Within this regard; preparing the policy related to personal data protection and extermination is mandatory for the data controllers who are obliged to register to the Data Controller Registry. The minimum information including but not limited to periodic extermination durations shall be regulated under the mentioned policy. However; since the Data Controller Registry is not established yet, the Board has not announced the list of the data controllers for whom the registration to the Data Controller Registry is obligatory.

The data controller who does not fulfill this obligation within the time specified by the Regulation shall be punished with imprisonment of one year to two years upon the reference of the Article 17 of the Law to the Article 138 of Turkish Criminal Code. Therefore, it will be to the benefit of data controllers to acquire professional help to determine whether responsibility to exterminate the data they process arose and if it did, to follow the required actions are taken within the time specified by the Regulation in order to not to face severe consequences like imprisonment.

Türkçe Versiyonu İçin

http://www.kasaroglu.av.tr/tr/kisisel-verilerin-silinmesi-yokedilmesi-anonimlestirilmesi

Previous Next

Publications

This website and the information herein has been designed in accordance with the Professional Rules of the Union of the Turkish Bars Association and in particular the regulations prohibiting advertisement by attorneys at law. All material included in the Kasaroğlu Web Site is for informational purposes only and Kasaroğlu Law Office expressly disclaims all liability to any person in respect of anything and in respect of consequences of anything done in reliance upon the whole or any part of the contents of the Kasaroğlu Web site. Transmission of this information is not intended to create and receipt does not constitute an attorney-client relationship between Kasaroğlu and the user or browser. No client or other reader should act or not refrain from acting on the basis of any matter contained in the Kasaroğlu site without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue. Kasaroğlu is not responsible for any third party contents which can be accessed through the web site.

The solution partner of Kasaroglu Law Office which provides extensive services in the field of Merging & Acquisation is “Kasaroğlu Uluslararası Danışmanlık Hizmetleri A.Ş." with its significant expertise and experience in this area.