Regulations on the Processing and Protection of Personal Data in the Right to Access Information Law
1.General
Law No. 4982 on the Right to Access Information was published on 24.10.2003 and came into effect six months later. This law includes regulations regarding the protection of personal data. The scope and application of the law are clearly defined in Article 2, stating, “This Law is applicable to the activities of public institutions and organizations, as well as professional organizations with public institution qualities.”
2.Right to Information and Obligation to Provide Information
Article 4 of the law, titled “Right to Information,” states, “Everyone has the right to access information. Foreigners residing in Turkey and foreign legal entities operating in Turkey may benefit from the provisions of this Law, provided that the requested information is related to themselves or their activities and within the framework of reciprocity principles. The rights and obligations arising from international agreements to which Turkey is a party are reserved.” Furthermore, Article 5, titled “Obligation to Provide Information,” stipulates that institutions and organizations are obligated to provide any information or documents not covered by exceptions in this Law for the benefit of applicants. They must take the necessary administrative and technical measures to effectively, promptly, and accurately conclude information requests.
When considering these two regulations together, it is evident that public institutions and organizations acting as data controllers, as well as public institutions with the characteristics of professional organizations, are obliged to provide necessary information to applicants, excluding the restrictions specified in the law when individuals, whether real or legal persons, make an application. Considering that we consider the relevant individual as a real person in the context of the protection of personal data, it can be seen that individuals can apply to public institutions and organizations as data controllers under this law. According to Article 11 of the Law, relevant public institutions are obligated to provide access to the requested information or documents within fifteen working days upon application.
The limitations of the right to access information include judicial activities subject to judicial review, information and documents related to state secrets, intelligence-related information or documents, information or documents related to the country’s economic interests, information or documents related to administrative investigations, information or documents related to judicial investigations and prosecutions, information or documents that violate the privacy of communication, information or documents classified as trade secrets, information or documents within the scope of the privacy of personal life, regulations related to internal practices of the institution, and information or documents related to intellectual and artistic works.
3.Protection of Personal Data and Privacy
Article 21 of the Law states that, except in cases where the individual allows, information or documents that would constitute unwarranted interference with a person’s health information, private and family life, honor and dignity, professional and economic values under the scope of privacy may not be disclosed under this law. However, in cases where public interest requires it, personal information or documents can be disclosed by institutions and organizations, with at least seven days’ prior notice to the relevant individual and obtaining written consent.
The term “personal data” is not explicitly used within Article 21 of the Law. It is stated that health information of an individual and information or documents that would constitute unwarranted interference with a person’s private and family life, honor and dignity, professional and economic values, except for health information, will not be shared without the consent of the individual concerned.
According to Article 32 of the Law, it came into effect six months after its publication on 24.10.2003. From the date the Law came into effect until 07.04.2016, when Law No. 6698 on the Protection of Personal Data came into effect, it is evident that the Right to Access Information Law, especially under Article 11, was effective in obtaining information from public institutions in the context of individuals’ right to learn. The scope of the Right to Access Information Law allows for the possibility of learning other information besides personal data, and it covers a broader area as individuals, both real and legal persons, can make applications. However, Law No. 4982, on the other hand, only addresses information requests from public institutions and organizations, not all data controllers. Additionally, Law No. 4982 does not necessarily ensure the fulfillment of all the rights specified in Article 11 of the Law on the Protection of Personal Data for the relevant individual. The time frame for obtaining information under the Law is set at 15 days, which is shorter than the 30-day period specified in the Law on the Protection of Personal Data. If a real person believes that their rights have been violated as a result of an application made under the Law on the Protection of Personal Data, they can file a complaint with the Personal Data Protection Board. Under the scope of Law No. 4982, the individual will directly apply to administrative justice.
Yalçın TORUN Attorney at Law
Warning
The above written text on our website is copyrighted to Attorney Yalcın TORUN. This written content is preserved over time with an electronic signature for the purpose of identifying ownership of intellectual property rights. The written texts on our website can be freely used by our fellow lawyers in their petitions; however, we do not permit the full, partial, or summarized publication of the texts on other websites without proper attribution.