TYPES OF PERSONAL DATA
Special Categories of Personal Data
National and international regulations recognize that certain personal data are considered special categories of personal data, which require stricter protective measures. The general rule regarding special categories of personal data is that these data cannot be processed except in the cases specified in the regulations.
According to Article 9 of the General Data Protection Regulation (GDPR) of the European Union, data revealing a person’s race or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; biometric data used for the identification of individuals; health-related data; data concerning a person’s sexual life and preferences; and genetic data are defined as special categories of data, and the processing of this data is prohibited except in the special circumstances outlined in the text. Before the GDPR, the 95/46/EC Directive issued by the European Union identified special categories of data in paragraph 8/1, where it can be seen that genetic data, biometric data used for the identification of individuals, and data concerning a person’s sexual orientation were not included in the special categories of data. Article 6 of the Personal Data Protection Law No. 6698 (KVKK) defines special categories of personal data as “data regarding individuals’ race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs; attire; membership in associations, foundations, or trade unions; health; sexual life; criminal convictions; and security measures, as well as biometric and genetic data.” When comparing the legal text with the GDPR and the 95/46/EC Directive, it is observed that data regarding individuals’ attire, information about membership in associations and foundations, criminal convictions, and data related to security measures have been included in the law as special categories of data, thus broadening the scope of special categories.
The Republic of Turkey is a party to the 108th “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data,” which was signed in Strasbourg on January 28, 1981, and approved on January 30, 2016. Article 6 of this convention identifies “personal data revealing racial origin, political opinions, religious or other beliefs, as well as personal data regarding health or sexual life” as special categories of personal data. It is noted that all special categories of personal data regulated in the 108th Convention are included in the KVKK.
When determining special categories of personal data, it is acknowledged that there are differences in international regulations, and even between the EU Directive and the Regulation. This raises the question of what criteria will be considered in determining which data qualifies as special categories of personal data and what values will be protected under these criteria. Accepting the protection of personal data as a human rights-based approach aimed at safeguarding individual privacy and personal life, there is a need for internationally accepted criteria to determine which types of personal data will be classified as special categories. Given that demands for fundamental rights and freedoms often arise when these rights and freedoms are violated, it is expected that the types of special categories of personal data will increase in the future. Additionally, it has been noted that some financial data, apart from the aforementioned special categories, are subject to special protection in the data protection laws of Denmark, Finland, Greece, the Netherlands, Portugal, and France.[1]
When examining special categories of personal data, it is evident that the individual’s identity is at the center of the data. The concept of identity is discussed by sociologists, philosophers, politicians, and other experts. Issues surrounding political identities, cultural identities, religious and ethnic identities, as well as subordinate and superior identities are addressed. “Identity issues relate to who a person or group is or how they see themselves. The characteristics one possesses do not constitute identity on their own; one must articulate what they are and recognize it as the essence of their being—or what is perceived as such. This identification can come from within the individual or from another source or group. Identities are labels we assign to different situations in which we find ourselves and how we position ourselves in those situations. The equivalents of the word ‘identity’ in foreign languages—’identity, identite, Identitat’—suggest similar meanings. However, today this term is often used to emphasize difference rather than similarity. Every individual who expresses their identity indirectly reveals their difference from others. The foundation of their self-positioning is fundamentally linked to ‘the other’ or ‘the others.’ Every ‘we’ is only possible in relation to a ‘you.'”[2]
“Identity is a matter of belonging related to what you share with others and what differentiates you from them. We all live with a potentially contradictory series of identities. The choice of which identity or identities to highlight is up to the individual.”[3]
“Identity is not only related to the unchangeable past of a person. In this context, adopting a forward-looking human identity means seeing the concept of the future as inherent in the concept of human identity; it involves viewing humans not merely through any design but recognizing their human possibilities and creating a set of conditions where these possibilities can be realized.”[4]
In references from individuals or groups outside of a person, the person can be defined by various identities related to their race, ethnic origin, political beliefs, philosophical convictions, religious beliefs, sect, or sexual life. A person can choose this definition themselves, but it can also be imposed by a group or another individual outside of themselves. Beyond their historical identity, a person may wish to carry only their human identity into the future to enhance human possibilities. Sometimes, individuals assert their cultural identities to demand cultural rights. The demand for cultural rights regarding identity (singular culture – cultura animi) can be expressed as the cultivation of the spirit and education, aimed at realizing human possibilities as a person. The education of an individual regarding their cultural identity and their development in accordance with their worldview fall within this scope. Some of the demands put forward considering cultural identities are collective identity-related demands concerning the culture of a group in a plural sense. Such demands can be evaluated within the scope of cultural rights as long as they include demands related to the realization of human possibilities. A person also demands not to be subjected to discrimination based on their identities and to be free from obstacles related to their identity when accessing fundamental rights and freedoms while realizing human possibilities. At the center of accessing fundamental rights and freedoms is the individual. Each person, defined by different identities as a member of the human species, possesses fundamental rights and freedoms. From this perspective, it becomes necessary for a person to determine their own future and to be able to act without their identity being considered, aside from their human identity, while accessing fundamental rights and freedoms. The determination of a person’s identity regarding their race, ethnic origin, political beliefs, philosophical convictions, religion, sect, or other beliefs, sexual life, clothing and appearance, membership in associations, foundations, or unions, and the personal data concerning these matters cannot be processed without the person’s consent, allowing them to plan their own future and use human possibilities securely.
In addition to the cultural identities we have tried to explain above, there are often health data of a person that are not related to cultural identities. Simply put, an individual may wish to conceal data related to health issues and illnesses for various reasons, sometimes even from their closest ones. A person suffering from an incurable disease might only want the healthcare personnel who diagnosed it to know about it. This data is fully within the scope of a person’s right to plan their own future and develop themselves, and it is data that must be protected.
The processing of sensitive personal data is prohibited except in exceptional cases. This is expressed as a definitive processing prohibition.[5]
Exceptions to the absolute prohibition of processing exist. The first exception to this prohibition is the consent of the data subject. The matter of processing sensitive personal data with the explicit consent of the individual is regulated in Article 8(2)(a) of Directive 1995/46/EC, Article 9(2)(a) of the GDPR, and Article 6(2) of the Personal Data Protection Law (KVKK). There is no regulation concerning the form of consent in the directive, regulation, and KVKK. Article 5 of the Italian Personal Data Protection Law states that consent for the processing of sensitive personal data by legal entities must be in writing, while Article 4 of the Federal German Personal Data Protection Law stipulates that consent must be in writing except in special cases.[6]
Beyond explicit consent, the directive, regulation, and law specify under which circumstances personal data may be processed. Article 8(2)(c) of the directive and Article 9(2)(c) of the GDPR allow for the processing of sensitive personal data without explicit consent in situations where it cannot be obtained. Article 6(3) of KVKK states that explicit consent is not required for data related to sexual life and health when performing medical diagnoses, treatments, and care services.
As a result of the special protection for sensitive personal data, actions violating the protection of this data are subject to heavier penalties under criminal law. The norms related to the protection of personal data in the Turkish Penal Code (TCK) are regulated in Articles 135 to 140. Article 135(2) of the TCK states that “if personal data relates to individuals’ political, philosophical, or religious views, racial origins; or unlawfully relates to moral tendencies, sexual lives, health statuses, or union affiliations, the penalty provided for in the first paragraph shall be increased by half.” It can be seen that membership in associations and foundations, biometric and genetic data, criminal conviction and security-related data, and data related to appearance are not included in the special protection under Article 135 of the TCK, while moral tendencies not covered by KVKK are included in the special protection under Article 135 of the TCK. The provision for increasing penalties for crimes against the protection of sensitive personal data by half was introduced by Article 30 of Law No. 6698, published on April 7, 2016.
Non-Sensitive Personal Data
The concept referred to as data includes all data concerning natural persons, legal entities, and public legal entities, as well as other state institutions. The term “data protection” encompasses the protection of data belonging to all institutions, both public and private law entities, as well as natural persons mentioned above. The concept of personal data protection specifically refers to the protection of data belonging to natural persons. Within personal data, both sensitive personal data and non-sensitive personal data are included. The data that does not fall under the category of sensitive personal data, as identified above, is referred to as non-sensitive personal data. In other words, data such as a person’s identification number, name, surname, place and date of birth, parents’ names, residential address, educational background, profession, bank account information, phone number, email address and passwords, marital status, financial assets, owned shares and accounts, debts, and shopping history are all considered non-sensitive personal data. All personal data, regardless of whether it is sensitive or not, is protected by the legal system. For personal data to be processed, the consent of the individual or the emergence of legally defined circumstances is required. Special regulations have been established in the legal system for the protection of sensitive personal data. Article 20 of our Constitution states, “Everyone has the right to request the protection of personal data related to them. This right includes being informed about personal data concerning oneself, accessing this data, requesting its correction or deletion, and learning whether it is used for the intended purposes. Personal data may only be processed in cases provided for by law or with the explicit consent of the individual. The principles and procedures regarding the protection of personal data are regulated by law.” As seen in this regulation, there is no distinction between sensitive and non-sensitive personal data in our Constitution. Article 8 of the European Convention on Human Rights, titled “Right to Respect for Private and Family Life,” states, “Everyone has the right to respect for his private and family life, his home, and his correspondence,” which does not even mention the concept of personal data.
In Article 5 of KVKK, the conditions for processing non-sensitive personal data are specified, while Article 6 outlines the conditions for processing sensitive personal data. Upon close examination of these regulations, it is evident that the basic rule is that explicit consent from the individual is a prerequisite for processing all personal data, and that processing personal data without explicit consent is exceptional, necessitating clear legal provisions for the processing of personal data without consent. The KVKK does not specify the form of explicit consent. The Italian Personal Data Protection Law requires that consent for processing sensitive personal data by legal entities must be in writing.[7] In the existing regulations on the protection of personal data and sensitive personal data in KVKK, Article 6(4) states, “In the processing of sensitive personal data, adequate measures determined by the Board must be taken,” granting authority and responsibility to the Board for ensuring adequate measures for the protection of sensitive personal data. Since the situations in which personal data can be processed without explicit consent are regulated by law as mentioned in Article 5 of KVKK, this provision also allows for the processing of sensitive personal data without explicit consent, thus not creating a distinction or additional protection for sensitive personal data but rather providing an equal level of protection. On the other hand, Article 6 of KVKK states, “Personal data related to health and sexual life may only be processed without seeking the explicit consent of the data subject by persons or authorized institutions and organizations under an obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, and the planning and management of health services and financing,” establishing a separate legal area for the processing of sensitive personal data related to health and sexual life. In this context, it appears that there is no practical difference between the protection of sensitive personal data and the protection of personal data, and that this difference remains theoretical for now.
[1] Aydın AKGÜL, Danıştay ve Avrupa İnsan Hakları Mahkemesi Kararlarında Kişisel Verilerin Korunması, İstanbul, 2016, s.23
[2] Elli Yıllık Deneyimlerin Işığında Türkiye’de ve Dünyada İnsan Hakları, Yayına Hazırlayan İoanna Kuçuradi ve Bülent Peker, Kimlik Kimlikler ve İnsan Hakları, Harun Tepe, Ankara 2004 S 89-92.
[3] Jeffrya Weeks, Farklılığın Değeri, Kimlik/Topluluk/Kültür/Farklılık, Çev İrem SAĞLAMER s.85 aktaran; Harun TEPE Elli Yıllık Deneyimlerin Işığında Türkiye’de ve Dünyada İnsan Hakları, Yayına Hazırlayan İoanna Kuçuradi ve Bülent Peker, Kimlik Kimlikler ve İnsan Hakları, Harun Tepe, Ankara 2004 S.90.
[4] Elli Yıllık Deneyimlerin Işığında Türkiye’de ve Dünyada İnsan Hakları, Geçmişle Gelecek Arasında Kimlik Kimlik, Abdullah KAYGI, Ankara 2004 s.74
[5] A. Çiğdem AYAZGÖR, Kişisel Verilerin Korunması, Beta, İstanbul, 2016, s.21
[6] AKGÜL, s 28
[7] Akgül, s.27.
Av.Yalçın TORUN
WARNING
The written text published on our website above is owned by Attorney Yalçın TORUN. This written text is preserved with a time-stamped electronic signature for the purpose of establishing ownership rights. Written texts on our site may be freely used by our lawyer colleagues in their petitions; however, we do not permit the publication of the entire text, a part of it, or a summary on other websites without citation.