Intern Lawyer Tolga Koncagül
Abstract
Definition of personal data and the basis of the right to request protection of personal data
»Personal data is defined as all kinds of information belonging to an identified or identifiable natural person.Personal processing, on the other hand, defined as obtaining, recording, storing, preserving, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use, in whole or in part or as part of any data recording system.For natural persons, it is a fundamental right that derives its basis from Article 20 of the Constitution and Article 8 of the European Union Declaration of Fundamental Rights. Law No. 6698 on the Protection of Personal Data (LPPD), which was established on the basis of the Protection Directive, was accepted by the Parliament on 24.03.2016 and entered into force after being published in the official newspaper on 07.04.2016.
»Personal data is the right to be a person and its scope is stated in Article 2 of the LPPD as follows: ”The provisions of this Law are natural persons whose personal data are processed and the natural and legal persons who processes this data completely or partially automatically or by non-automatic means provided that they are part of any data recording system.” As it can be understood from the article, the right to request the protection of personal data is a right granted to natural persons, legal entities and deceased persons are not covered by this. Apart from the special verdicts regulated in the LPPD, general verdicts protecting personal rights are also regulated in the Turkish Civil Law and personal data can also be protected according to these law articles.
»All the articles of the law protecting personal data are interpreted according to the general principles of the law on protection of personal data. In the doctrine, personal data are divided into two categories: Personal data is divided into “special categories of personal data” and “general personal data”. Listed in Arcticle 6, “Special categories of personal data” entails personal data relating to the ethnic origin, political opinion, philosophical belief, religion, sect or oher belief, clothing, membership to associations, foundations or trade union, health, sexual life, convictions and security measures and the biometric and genetic data are deemed to be special ctegories of personal data. The matters stated in the article are subject to the limited number principle. All kinds of data covered by this are considered within the scope of “special categories of personal data” . General personal data, on the other hand, is considered as any data that does not fall within the scope of “special categories of personal data” . All kinds of data that emerge with technological innovations and are not added to the article regulating the scope of “special categories of personal data” within the scope of general personal data. Unlike “special categories of personal data” , the limited number principle does not apply to general personal data.
Definition and conditions of processing personal data
»The definition of the processing of personal data is specified in the clause e of Article 3 of the LPPD, in the article: Obtaining, recording, storing, preserving, changing, reorganizing, explaining personal data completely or partially automatically or non-automated provided that it is part of a data recording system. Any transaction performed on data such as transferring, taking over, making available, classifying or preventing their use.
»The conditions for the processing of personal data are also specified in Article 5 of the same law and are subject to the principle of limited number. In cases where it is necessary for the protection of the life or body integrity of the person or someone else who is unable to disclose his consent due to his consent or whose consent is not legally valid, if it is necessary for the data controller to fulfill his legal obligation, in cases where it is disclosed to the public by the person concerned, the determination and use of a right data processing is mandatory for the legitimate interests of the data controller, as long as it does not damage the fundamental rights and freedoms of the person concerned.
Definition of Consent and Giving Consent to the Processing of Personal Data
»According to LPPD, consent means giving consent to the processing of the data that the person has, at their own request or upon the request from the other party.In European Union Directive 95/46 EC explicit consent is understood as a declaration of consent given by the data subject freely, having sufficient information on the subject, open to no hesitation and limited only to that process . European Union, explicit consent for processing is only required on data includes special nature. In our country, explicit consent is required for the processing of all kinds of personal data. In this respect, our Law is more protective compared to the European Union regulations. The consent disclosure is a guide for the data processor about the action to be taken. The person actually notifies the data processor the decision he has made regarding his own legal value with the consent statement.
»The consent disclosure allows the person concerned to determine the limits, scope, realization method and duration of the data permitted to be processed. Other than the exceptions provided for by law, explicit consent is not subject to written form. Explicit consent can also be obtained electronically. If the personal data is processed on the basis of one of the conditions other than the express consent of the person concerned, the consent of the person concerned is not sought. The point to be considered is that data processing can be processed on the basis of an explicit non-consent condition, but the processing of data based on explicit consent will be deemed to be an abuse of the right. For example, the employer will give a bonus for one year to encourage the employee and for this, the employer asks permission to keep the record of the personal information of the one who gets the bonus. In that case employer is able to benefit from the legitimate interest of the data controller but employer based on the condition of express consent, that means ıf the employee withdraws the consent, the data controller’s continuing the data processing activity based on one of the other personal data processing conditions will constitute a transaction against the law and the rules of honesty. Finally, the purpose of personal data activity may be based on more than one personal data processing condition.
Principles
General Scope
»The principles regarding the collection and processing of personal data are derived from the EU directive and regulated in Article 4 of the LPPD. Article 4 says;
“General principles Article 4-(1) Personal data can only be processed in accordance with the procedures and principles stipulated in this Law and other laws.
(2) It is mandatory to comply with the following principles in the processing of personal data:
a)Compliance with the law and good faith.
b)Being accurate and up-to-date when necessary.
c)Processing for specific, explicit and legitimate purposes.
d)Being connected, limited and measured for the purpose for which they are processed.
e)Being kept for the period stipulated in the relevant legislation or required for the purpose for which they are processed”
»These principles, which are essential for the protection of data, are interlinked and these principles must be followed. This situation also constitutes the basis in terms of compliance with all legal regulations within the scope of the protection of personal data. In order to understand the connection between the principles described above more easily, we can explain as follows; The principle of compliance with the law and the rule of honesty is not only a principle specific to the protection of personal data, it is an essential principle in all areas of law. The general principles listed in the article on the protection of personal data do not contain concrete, rigid rules. These principles include rules on compliance with data protection regulations. Failure to comply with these principles constitutes unlawfulness.
These principles are explained below in order.
Compliance with the law and good faith
»As in other areas in our legal system, it is taken into account here. If the data is processed within the scope of “explicit consent” or one of the reasons for compliance with the law for which the processing is explicitly permitted by the laws, the data processing becomes legal. The data controller should take into account the interests and reasonable expectations of the data subjects while performing the data processing purposes. The person concerned should avoid actions and procedures that prevent the occurrence of unexpected and unnecessary results. As a requirement of the principle, it is also necessary for the data subject to be transparent for the data subject and to act in accordance with the information and warning obligations of the data controller.
»One of the decisions of the Personal Data Protection Board regarding this issue is given 07/11/2019 and numbered 2019/331. The subject of the violation is the processing of personal data made public by the relevant person for purposes other than publicization, the Complainant’s personal data is accessed from the website that was previously made public by the Company. Since it is understood that the information is not used for the purpose of presenting and publicizing the information on the website, in other words, it is not attempted to reach the Complainant in order to benefit from the professional competence of the Complainant, on the contrary, it is understood that the Complainant is called with an appointment request regarding the Company’s activities, It has been concluded that the data processing activity carried out by the Company cannot be evaluated within the framework of subparagraph (d) of paragraph (2) of Article 5 of the Law on the Protection of Personal Data No.6698, and within this scope, the Company shall be required to provide any necessary security level in order to prevent the illegal processing of personal data. It has been decided to impose an administrative fine of 100,000 TL on the Company in accordance with sub-clause (b) of paragraph (1) of Article 18 of the Law, due to the fact that it violated sub-paragraph (a) of paragraph (1) of Article 12 of the Law by not taking any technical and administrative measures.
The principle of being accurate and up-to-date when necessary
»The principle of being accurate and up-to-date when necessary brings an obligation of active care. As required by the active diligence obligation, the data controller has to provide the conditions that will allow the data to be corrected. This principle, which refers to the fact that personal data must be accurate and up-to-date, is a result of the right of the person concerned to request the correction of the data.
»Keeping personal data in an accurate and up-to-date manner is both compatible with the interests of the data controller and also important in terms of protecting the fundamental rights and freedoms of the relevant person. In cases where the address is important in transactions, it may cause problems.
The principle of processing for certain explicit and legitimate purposes
»The principle of processing for certain explicit and legitimate purposes is regulated in the law in order to ensure that the relevant personal data transactions can be clearly understood by the party whose data is processed, the legal basis of the personal data processing activities is certain, the personal data processing activity and the purpose of the activity are clearly revealed. Although not explicitly stated in the law, this principle is intertwined with the principle of accountability. The purpose must be clear and legitimate.
»For example, it is not legitimate for an online store to process the TR ID number as data, except for the customer’s name and surname, so it is against this principle. Another example of this principle is the Decision of the Personal Data Protection Board dated 27/02/2020 and numbered 2020/173. In the decision; As a result of the application made about personal data processed by Amazon Turkey Retail Services Limited Company for the purpose of creating a member account required for shopping, accepting the “Terms of Use and Sales” and granting electronic communication permission cannot be considered as an express consent given by free will, therefore, personal data Since the principles of “compliance with the law and the rules of honesty”, “processing for specific, clear and legitimate purposes” and “being connected, limited and proportionate to the purpose of processing” are not complied with and the data controller violates Articles 8-9 of the KVKK, It has been decided to impose an administrative fine of 1,100,000 TL within the scope of subparagraph (b) of Article (1) of Article 18 of the Law for failure to fulfill the obligations in paragraph (1) of the article.”
The principle of being relevant, limited and proportionate to the purpose
»The principle of being relevant, limited and proportionate to the purpose for which they are processed is also called the principle of data economy and aims to process data sufficient for the purpose. highlights. “The principle of proportionality comes to the fore when processing personal data in cases where it is not possible to reach the goal without data processing.” The reason for such a restriction is to prevent violations of certain rights of individuals such as privacy of private life and freedom of communication.
»In the Council of State’s 11th Office of the Presidency of the Decision number 2017/816 and 2017/4906, it is stated that “the practice of controlling the personnel of the governmental administration with face recognition system is within the scope of taking personal data from the personnel and is within the scope of the principle of “privacy of private life” even in the public sphere. Considering that there is no legal basis showing the limits of the application and the principles and procedures as of the date of the action, and there is no assurance that the collected data cannot be used in any other way in the future, the action subject to the action incompatible with the fundamental rights and Constitutional principles and the court decision on the rejection of the case. There is no compliance with the law. ” That decision is based on the principle of being relevant, limited and proportionate to the purpose.
The principle of preservation for the period stipulated in the relevant legislation or for the purpose
»The principle of preservation for the period stipulated in the relevant legislation or for the purpose for which they are processed emphasizes the necessity of keeping it for the period determined in the legislation or required for the purpose for which they are processed, if any. If there is no legal obligation or ıf the personal data served its purpose of use ,the data must be destroyed or anonymized.
»If there is no article in the law about when the data should be destroyed, the time required for the purpose must be determined objectively. This determination is made by the personal data protection board. In case of failure to comply with the time determined by the Board, punishment of those who do not comply with the time period is determined in Turkish Penal Code article 138.