TYPES OF PERSONAL DATA
Special Categories of Personal Data
In national and international regulations, it is observed that certain personal data is considered to be of a special nature, and stricter measures are taken to protect such data. The general rule regarding special categories of personal data is that these data cannot be processed, except for the exceptional cases specified in the regulations.
In Article 9 of the General Data Protection Regulation (GDPR) of the European Union, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, biometric data used for identifying natural persons, health data, data concerning a person’s sex life and sexual orientation, and genetic data are defined as special categories of personal data. Processing of these data is prohibited, except for the specific exceptions outlined in the text.
Before the Data Protection Regulation, the 95/46/EC Directive issued by the European Union also listed special categories of data in Paragraph 8/1. Under this directive, it is evident that genetic data, biometric data used for identifying individuals, and data regarding a person’s sexual orientation were not included in the special categories of personal data.
According to Article 6 of the Turkish Personal Data Protection Law No. 6698 (TPDPL) titled “Conditions for the Processing of Special Categories of Personal Data,” special categories of personal data are defined as: “Personal data revealing an individual’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and attire, membership in associations, foundations, or trade unions, health data, sexual life, criminal convictions and security measures, as well as biometric and genetic data.” When comparing the law with the GDPR and the 95/46/EC Directive, it is observed that data regarding clothing and attire, membership in associations, foundations, or trade unions, and criminal convictions and security measures have been included in the scope of special categories of personal data under the law, thereby expanding the scope of special categories of personal data.
The Republic of Turkey, which is a party to the Convention No. 108 titled “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data,” signed in Strasbourg on January 28, 1981, and approved on January 30, 2016, recognizes “personal data revealing racial origin, political opinions, religious or other beliefs, as well as personal data concerning health or sex life” as special categories of personal data in Article 6, titled “Special Categories of Data” of the Convention. It is seen that all the special categories of personal data regulated in the Convention No. 108 are also included in the content of the Turkish Personal Data Protection Law (TPDPL).
Considering that there are differences in international regulations regarding the identification of special categories of personal data, and even differences between the European Union’s Directive and Regulation, the question arises as to what criteria should be taken into account when determining which data constitutes special categories of personal data, and what values should be protected by these criteria.
If we adopt a human rights-based approach, which views the protection of personal data as a means of safeguarding an individual’s privacy and personal life, then, in parallel with this approach, there is a need for internationally accepted criteria to determine which types of personal data should be classified as special categories of personal data.
When considering that requests for the protection of fundamental rights and freedoms typically arise when these rights and freedoms have been violated, it is expected that the number of special categories of personal data will increase in the future. In addition to the special categories of data mentioned above, it is observed that some financial data are also subject to special protection under the data protection laws of countries such as Denmark, Finland, Greece, the Netherlands, Portugal, and France.
When we look at special categories of personal data, we see that the central element of the data is the identity of the person. The concept of identity is discussed by sociologists, philosophers, politicians, and experts from various other fields. Discussions involve political identities, cultural identities, religious and ethnic identities, as well as social and personal identities, and identity issues. “Identity issues are related to who a person or group is or how they perceive themselves.” Characteristics alone do not form identity; a person must articulate what they possess and recognize it as what defines them or what they believe to be their defining feature. This identification of identity can come from the person themselves or from another place or group. Identities are the names we give to the different situations that position us and in which we position ourselves. Looking at the equivalent of the word “identity” in foreign languages— “identity,” “identité,” “Identität”— it is seen that they imply “sameness” or “similarity.” However, today, this term is used more as a concept that emphasizes difference rather than sameness. Every person who expresses their identity indirectly highlights their difference from others. When positioning oneself, the concept of the “Other” is often invoked. Every “we” is only possible because of “you.” Identity is a sense of belonging related to what is shared with some other people and what differentiates one from others. We all live with a potentially contradictory series of identities. The choice of which identity or identities to emphasize depends on the individual.
Identity is not just about an unchangeable past. Adopting a human identity oriented towards the future means seeing the concept of future embedded within the concept of human identity; it is about focusing not on a predefined view of human beings, but on looking at humans themselves, recognizing the potential they carry, and creating a set of conditions where these potentials can be realized.
A person can be identified by different identities, such as their race, ethnic origin, political beliefs, philosophical beliefs, religious beliefs, sect, sexual life, and other characteristics from others, either by themselves or by a group or another individual. A person may wish to move beyond their past identity and, by carrying only their human identity, work towards developing human potential. Sometimes, individuals assert their cultural identities and make claims for cultural rights. The cultural rights claim related to identity (singular culture— cultura animi) refers to the development of human potentials and education, which are aimed at realizing an individual’s capabilities as a person.
Education directed towards a person’s cultural identity and self-development according to their worldview falls within this scope. Some of the claims made based on cultural identities are related to the collective identity of a group, and these claims can be seen as cultural rights as long as they concern the realization of human potentials. In addition, the individual may also demand not to be discriminated against based on their identity and to be able to pursue fundamental rights and freedoms without hindrance.
When pursuing fundamental rights and freedoms, the individual remains at the center. Each person, defined by different identities as individuals of the human species, has fundamental rights and freedoms. From this perspective, it becomes essential for individuals to be able to act in a way that is not influenced by an identity other than their human identity while determining their future and securing their rights. The processing of personal data regarding a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, sexual life, clothing and attire, membership in associations, foundations, or trade unions without their consent protects the individual’s ability to determine their future and use their potential in a secure environment.
Apart from the cultural identities explained above, there are also health-related data, which are not always directly related to cultural identities. For example, an individual may want to hide health issues and diseases from even their closest family members for various reasons. A person suffering from an incurable disease may only wish for the healthcare professional who diagnoses them to know about it. These data, related to a person’s private life, fall within the rights of personal autonomy, self-determination, and the protection of future planning, and they must be protected.
Processing of Special Categories of Personal Data
Processing of special categories of personal data is prohibited, except in exceptional cases. This is referred to as an absolute processing ban. However, there are exceptions to this absolute processing ban. The first exception to the absolute processing ban is the consent of the data subject. The provision that special categories of personal data may be processed with the explicit consent of the individual is outlined in Article 8(2)(a) of Directive 95/46/EC, Article 9(2)(a) of the GDPR, and Article 6(2) of the Turkish Personal Data Protection Law (TPDPL). However, there is no regulation regarding the form of consent in the Directive, Regulation, or the TPDPL. The Italian Personal Data Protection Law (Article 5) requires that consent for the processing of special categories of personal data by legal entities must be in writing, and the German Federal Data Protection Act (Article 4) also mandates written consent, except in specific cases.
In addition to explicit consent, the circumstances under which personal data may be processed are determined by the Directive, Regulation, and the law. Article 8(2)(c) of the Directive and Article 9(2)(c) of the GDPR provide that special categories of personal data can be processed without explicit consent if explicit consent cannot be obtained. In Article 6(3) of the KVKK, it is specified that no explicit consent is required for processing health data or data related to sexual life in the context of medical diagnoses, treatment, and healthcare services.
As a result of the special protection afforded to special categories of personal data, violations of the protection of such data are subject to stricter penalties under criminal law. In the Turkish Penal Code (TPC), provisions related to the protection of personal data are outlined between Articles 135 and 140. Article 135/2 of the TPC states that “In cases where personal data relates to individuals’ political, philosophical, or religious views, racial origins, unlawful moral tendencies, sexual life, health status, or union affiliations, the penalty stipulated in the first paragraph will be increased by half.” Under the TPDPL, special categories of personal data, such as association and foundation membership, biometric and genetic data, data related to criminal convictions and security measures, and data related to clothing, are not included in the special protection under Article 135 of the TPC. However, moral tendencies, which are not included in the TPDPL, are protected under Article 135 of the TPC. The regulation concerning the increase of penalties by half for violations of the protection of special categories of personal data was introduced by Article 30 of Law No. 6698, published in the Official Gazette No. 29677 on April 7, 2016.
Non-Special Categories of Personal Data
The concept of “data” encompasses all types of data, including data held by natural persons, legal entities, public legal persons, and other state institutions. The term “data protection” refers to the protection of the data of all the aforementioned entities, both public and private legal persons, as well as natural persons. The concept of personal data protection refers specifically to the protection of data held by natural persons.
Within personal data, we include both special categories of personal data, as mentioned above, and non-special categories of personal data. Data that does not fall under the special categories of personal data, as identified above, is referred to as non-special categories of personal data. In other words, data held by a natural person that is identifiable and not classified as special personal data includes the individual’s identification number, name, surname, place and date of birth, parents’ names, address, education level, profession, bank account details, phone number, email address and passwords, marital status, financial assets, shares and accounts, debts, purchase history, credit card data, etc. All types of data belonging to a person that are not classified as special categories of personal data are considered non-special categories of personal data.
Regardless of whether data is classified as special or not, all personal data is protected by the legal system. For personal data to be processed, the consent of the individual or the occurrence of situations stipulated by law is required.
Protection of Special Categories of Sensitive Personal Data
Special regulations have been established within the legal system to protect special categories of sensitive personal data. Article 20 of our Constitution states:”Everyone has the right to request the protection of personal data related to themselves. This right includes being informed about personal data related to them, accessing this data, requesting the correction or deletion of such data, and learning whether it is used in accordance with its intended purposes. Personal data may only be processed in cases specified by law or with the explicit consent of the individual. The principles and procedures regarding the protection of personal data shall be regulated by law.”As seen in this provision, our Constitution does not distinguish between special categories of personal data and non-special categories of personal data.
The European Convention on Human Rights, which forms the basis for the protection of personal data, contains a provision in Article 8 titled “Right to respect for private and family life,” which states:”Everyone has the right to respect for his private and family life, his home, and his correspondence.”This provision does not even mention the concept of personal data.
In Article 5 of the TPDPL, the conditions for processing personal data that are not classified as sensitive (special categories of personal data) are specified, while Article 6 outlines the conditions for processing sensitive personal data. When these regulations are closely examined, it becomes clear that the basic rule is that the explicit consent of the individual is required for the processing of all personal data. It is an exception to process personal data without explicit consent, and the necessity of a specific legal provision in the law for processing personal data without consent is evident. The TPDPL does not regulate the form of explicit consent. However, the Italian Data Protection Law stipulates that consent must be given in writing when processing sensitive personal data by legal entities. (7) In the TPDPL, regarding the protection of both personal data and sensitive personal data, Article 6/4 states, “In the processing of sensitive personal data, adequate measures determined by the Authority must also be taken.” This provision grants the Authority the power and responsibility to ensure sufficient safeguards for the protection of sensitive personal data.
Article 5 of the TPDPL mentions situations where personal data can be processed without explicit consent, and since these situations are clearly regulated by law, the same applies to sensitive personal data, meaning that sensitive personal data can also be processed without explicit consent under specific legal provisions. As a result, this does not create additional protection or differences, but rather ensures equal protection for both personal data and sensitive personal data. Furthermore, in Article 6 of the TPDPL, it is specifically stated that “Personal data related to health and sexual life can be processed without the explicit consent of the individual only for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons or institutions that are bound by a confidentiality obligation.” This regulation creates a separate legal framework for processing sensitive personal data related to health and sexual life. In this context, it can be observed that there is no practical difference between the protection of sensitive personal data and the protection of personal data, and this difference remains theoretical for now.
Av. Yalçın TORUN
Web sitemizde yayımlanan yukarıdaki yazılı metnin, eser sahipliği hakları Av.Yalçın TORUN’a aittir. Bu yazılı metin hak sahipliğinin tespiti amacıyla zaman içerikli elektronik imza ile muhafaza edilmektedir. Sitemizdeki yazılı metinler avukat meslektaşlarımız tarafından dilekçelerinde serbestçe kullanılabilir, fakat metinlerin tamamının, bir kısmının veya özetinin atıf yapılmaksızın başka web sitelerinde yayınlanmasına iznimiz yoktur.