THE CONCEPT OF PERSONAL DATA PROCESSİNG
In the European Union Data Protection Directive (EU 95/46/EC), Article 2(b) defines the processing of personal data as “any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; classification, storage, use, retrieval, distribution, deletion, destruction, collection, etc.
In the General Data Protection Regulation of the European Union (GDPR), Article 4/2 defines the processing of personal data as “any operation or set of operations performed on personal data or a set of personal data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; classification, storage, use, retrieval, distribution, restriction, deletion, destruction, collection, etc., performed by automated or non-automated means.”
It is observed that there is no substantial difference between the definitions in the Directive and the Regulation, with only a few wording changes in the Regulation that do not affect the core essence of the concept.
In the Turkish Personal Data Protection Law (TPDPL), Article 3(e) clarifies the concept of personal data processing. The law defines personal data processing as: “Any operation performed on personal data, including but not limited to obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, receiving, making accessible, classifying, or preventing access to such data, through automatic or non-automatic means, as part of any data filing system.”
In the definitions made in the relevant regulations concerning personal data processing, the actions to be carried out on personal data are determined by enumerating them, but it is also stated that similar activities to those listed will also be considered as part of personal data processing. Likewise, the methods used to process data are not limited. Personal data can be processed both by automated systems (such as computers) and manually by individuals performing similar actions without automation. For example, negotiating personal data without recording it would still be considered processing the data.
The collection of personal data is one of the actions recognized as part of personal data processing. It does not matter how or for what purpose personal data is collected. For example, taking photographs of individuals by tracking them, recording their GPS coordinates, listening to phone calls and recording personal data from the conversations, all fall under personal data processing.
The act of recording collected personal data on CDs, MP3s, DVDs, portable memory devices, etc., is considered a separate processing action from merely collecting personal data. Similarly, preserving recorded personal data is another distinct action. Activities such as copying personal data into image files, audio files, etc., represent another form of processing. Modifying personal data is also a separate form of processing. Deleting or destroying personal data that has been collected, stored, and modified is yet another form of processing. The transfer of personal data between individuals also constitutes personal data processing, with both the transferor and the transferee considered to have processed the data.
In the context of Data Mining and Big Data, obtaining data from different sources, classifying it, analyzing it, combining it, and deriving new conclusions based on the analysis are also actions that are considered personal data processing. The actions described above do not cover all possible activities related to personal data processing. In general, any action or activity performed on personal data will be considered data processing. The law does not attempt to provide an exhaustive definition, as indicated by the use of the word “like,” which avoids a restrictive or exhaustive list of actions.
The concept of personal data processing has also been discussed in the decisions of the Court of Justice of the European Union (CJEU). Notably, uploading personal data to websites has been defined as personal data processing. Even if the data is already publicly available through other means, systematic web scraping by search engines and presenting such data in lists is still considered personal data processing. The fact that data has been made public on other platforms does not affect the existence of data processing activities.
Av. Yalçın TORUN
Web sitemizde yayımlanan yukarıdaki yazılı metnin, eser sahipliği hakları Av.Yalçın TORUN’a aittir. Bu yazılı metin hak sahipliğinin tespiti amacıyla zaman içerikli elektronik imza ile muhafaza edilmektedir. Sitemizdeki yazılı metinler avukat meslektaşlarımız tarafından dilekçelerinde serbestçe kullanılabilir, fakat metinlerin tamamının, bir kısmının veya özetinin atıf yapılmaksızın başka web sitelerinde yayınlanmasına iznimiz yoktur.