WHAT IS PERSONAL DATA?
Personal data is defined in the Law No. 6698 on the Protection of Personal Data. Personal data refers to any information relating to an identified or identifiable natural person. According to the Law, the 3 basic elements that the concept of personal data should have are as follows:
Belonging to a natural person
Making a person specific or identifiable
Containing all kinds of information
It is obvious that the scope of personal data is very wide. However, to give a few examples:
Identity information
Contact details
Address information
Hobby
Letter
Job application forms
Interview minutes
Customer complaint form
CVs
Credit and debit card statements
Fingerprint
Examples such as health information etc. can be further multiplied.
WHAT IS THE PROCESSING OF PERSONAL DATA?
Processing of personal data refers to all kinds of operations performed on personal data such as obtaining, recording, storing, preserving, modifying, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system. Data controllers who process personal data have certain obligations under this law. The most important of these obligations is to inform the natural person whose data is processed and to obtain his/her informed consent.
WHAT IS THE OBLIGATION TO INFORM?
The obligation to inform consists of informing the data subject on a certain subject. Fulfilment of the obligation to inform does not depend on the consent of the data subject.
The Law grants the data subjects whose personal data are processed the right to obtain information by whom. For what purposes and for what legal reasons these data may be processed, and to whom and for what purposes they may be transferred, and addresses these issues. Within the scope of the data controller’s obligation to inform. Accordingly, the data controller is obliged to provide the following information to the data subject personally or through. The person authorised by him/her during the acquisition of personal data within the framework of Article 10 of the Law:
Identity of the data controller and its representative, if any,
The purpose for which personal data will be processed,
To whom and for what purpose personal data may be transferred,
The method and legal reason for collecting personal data,
other rights listed in the article.
In cases where the data processing activity depends on the explicit consent. Of the data subject or the activity is carried out under another condition in the Law. The data controller’s obligation to inform the data subject continues. In other words, the data subject must be informed in every case where his/her personal data is processed.
WHAT IS KVKK CLARIFICATION TEXT?
Pursuant to KVKK, data controllers are obliged to inform. The data subjects whose personal data they process. Although the obligation to inform is an obligation for data controllers. It is also considered as a right for natural persons whose personal data are processed.
The KVKK disclosure text should at least include; the identity of the data controller and its representative, if any, the purpose for which personal data. Will be processed, to whom and for what purpose personal data can be transferred. The method and legal reason for collecting personal data, and other rights listed in Article 11. The KVKK disclosure text that does not contain this information in full. May cause the data controller not to fully fulfil its disclosure obligation.
In addition, if the personal data processing activity depends on the explicit consent. Of the data subject, the data controller’s obligation to inform and obtain explicit consent must be fulfilled separately.
HOW TO PREPARE KVKK CLARIFICATION TEXT?
The obligation to inform can also be fulfilled. By methods such as voice recording, verbal expression, pasting on the board. However, when the burden of proof that the person. Whose data is processed has been informed is on the data controller. It will be useful to have the clarification text in written form. It is important to use a clear, understandable and plain. Language in the clarification text to be prepared.
IS IT NECESSARY TO APPROVE THE KVKK CLARIFICATION TEXT?
The clarification text is a unilateral obligation. For this purpose, it is sufficient to announce the clarification. Text and it does not need to be approved. By the relevant persons. However, if it is necessary for the data controller. To obtain explicit consent for the personal data to be processed. Under the law, this should be fulfilled as a separate obligation.
CAN THE OBLIGATION TO INFORM AND THE OBLIGATION TO OBTAIN EXPLICIT CONSENT BE FULFILLED TOGETHER?
According to Article 5/f of the Communiqué on the Procedures and Principles. To be Followed in the Fulfilment of the Disclosure Obligation, “In case the personal data processing activity is carried out based on the explicit consent condition. The obligation to inform and obtaining explicit consent. Must be fulfilled separately.” It is stated.
The data controller must first fulfil the disclosure obligation and then obtain explicit consent.
IS THE DISCLOSURE TEXT MANDATORY?
The data controller, who processes data in the capacity. Of data controller with legal definitions. Has the obligation to provide KVKK clarification text or obtain explicit consent depending. On the nature of the data processed. It will be useful to get legal support from your lawyer in order to determine. The scope of responsibility within the scope of the work you do and the data you process.
You can access our other article examples and petition examples by clicking