What does the law aim at? It aims to protect fundamental rights and freedoms.
So, was there no regulation on personal data in Turkey before this? The right to protect personal data was constitutionally guaranteed in our country in 2010.
Were there any regulations on this long before? There were regulations on the protection of personal data in the Turkish Civil Code and the Turkish Penal Code.
What is the relevant legislation on this subject? Constitution of the Republic of Turkey, KVKK No. 6698, Turkish Penal Code, Electronic Communication Law, Regulations, Communiqués
WHAT HAS CHANGED IN OUR LIVES WITH THE LAW ON THE PROTECTION OF PERSONAL DATA? Although the right to request the protection of personal data was included in the constitution in 2010, the content of the concept of personal data was not clear. With the KVKK, the concept of personal data was defined. Jurisprudence was shaped with the Board decisions. As a result, the applicability of the provisions of the Turkish Penal Code has also increased.
WHO IS COVERED BY THE LAW? Companies, enterprises, tradesmen, merchants, self-employed persons, professional chambers, bar associations, pharmacists, doctors
WHAT ARE THE CASES NOT COVERED BY THE LAW? The Law does not apply to those who process data without being part of any data recording system. Since the term “natural persons who process personal data” is used in the law, legal entities whose personal data are processed are also excluded from the scope of this law.
CIRCUMSTANCES ABSOLUTELY OUT OF SCOPE 1-Activities related to himself and his family members 2-Processing of personal data for purposes such as official statistics and research and planning by anonymising 3-Processing within the scope of freedom of expression for art, history and literature or scientific purposes 4-Processing within the scope of preventive activities managed by legally competent institutions for public order 5-Processing by judicial authorities for investigation, prosecution or execution
PARTIALLY OUT OF SCOPE 1-To prevent or investigate the commission of a crime 2-To be made public by the person himself 3-To carry out supervisory or regulatory duties and disciplinary work by public institutions and professional organisations of this nature 4-To be necessary for the protection of the economic and financial interests of the state in budget, tax and financial matters
SUMMARY OF THE JURISDICTION DATED 09.12.2019 NUMBER 2019/372 A newspaper columnist wrote that the complainant’s father was undergoing cancer treatment and that the complainant took a break from his job to take care of his father. The complainant stated that his father’s health data, which is private personal data, was processed without his consent and shared with third parties. The complainant also stated that he did not know that his father was undergoing cancer treatment until this date, that this information was kept from him by his family as he did not want to demoralise him, but that the person concerned was called with get well wishes after the date of the news, that the person concerned became withdrawn and cut off communication with his family and refused cancer treatment due to learning from newspapers and third parties that the person concerned had cancer. In this case, a significant fine was imposed on the newspaper in question.
WHAT IS EXPRESS CONSENT? It refers to the consent based on information on a certain subject and expressed with free will.
WHAT IS PERSONAL DATA? It is any information belonging to an identified or identifiable real person. name, surname, nickname……
WHAT IS THE PROCESSING OF PERSONAL DATA? For example, we went to a shop. What does the shop do? It saves our data.
WHO IS THE DATA PROCESSOR? It refers to the natural and legal person who processes personal data.
WHO IS THE DATA CONTROLLER? It refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. For example, the Union of Turkish Bar Associations is the data controller.
CAN LEGAL ENTITIES HAVE PERSONAL DATA? No, they do not. Legal entities appear as data controllers. In the event that the data in the electronic environment of the legal entity is requested by another legal entity, the provisions regarding unfair competition shall apply. Date of Decision: 19.11.2018 Decision no: 2018/131 This is the case if the former employee brings the portfolio information to the new company.
WHAT IS A DATA RECORDING SYSTEM? It refers to the recording system in which personal data are structured and processed according to certain criteria. It is contrary to the principle of protection of personal data for a bank to use the mobile phone number of the person concerned for purposes other than the purpose for which it was provided to the bank.
JURISDICTION 18.09.2019 DATE 2019/277 DECISION NO The person called by the bank from the phone number processed by the bank for banking transactions was told that he was called because his spouse could not be reached about the company where his spouse was a manager. Here, the KVKK board has revealed that this call made by the bank is not a limited and limited processing related to the purpose of processing.
JURISDICTION Decision on the non-deletion of personal data in accordance with the principle of retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed Decision Date: 05.12.2018 Decision No: 2018/142
Summary Regarding the application made to the institution due to the failure of the data controller to fulfil the request of the data subject to delete the personal data in the data recording system of a data controller bank
Conclusion: A decision establishing that the banking retention period is 10 years.
You can access our other article examples and petition examples by clicking