Data controller

Scope

The criterion that identifies the data controller is the authority to decide “why” and “how” processing activities are carried out. According to the explanation of the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), legal entities are themselves data controllers within the scope of their own activities, and legal liability arises in the person of the legal entity; in this respect no distinction is made between public and private law legal entities. The main obligations of the data controller are as follows: processing personal data in accordance with the principles and processing conditions in the Law (Art. 4–6); erasing, destroying or anonymizing data whose reason for processing has ceased to exist (Art. 7); informing the data subject when the data is obtained (Art. 10); taking technical and administrative measures for an appropriate level of security and, if the data is obtained by others through unlawful means, notifying the data subject and the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) as soon as possible (Art. 12); and, as a rule, concluding data subject applications within thirty days at the latest (Art. 13). Except for exceptions introduced by the Board, registration with the Data Controllers’ Registry (Veri Sorumluları Sicili) is mandatory before data processing begins (Art. 16).

Practical significance

Who the data controller is in a given operation is assessed less according to the labels used in the contract than according to who actually determines the purposes and means of processing. The data controller is jointly liable with persons who process data on its behalf for taking security measures (Art. 12/2); the choice of service provider and the contract terms are therefore important. Violation of the obligations on informing data subjects, data security, compliance with Board decisions and the registry may require an administrative fine (Art. 18); because the amounts stated in the Law may be updated, the applicable amount should be checked separately.

Commonly confused concepts

A data controller should not be confused with a data processor: the data controller determines the purposes and means of processing, whereas the data processor acts on its behalf under the authority given by the data controller. The data controller is also different from the “data subject,” the natural person whose data is processed (Art. 3/1-ç). Even if employees actually carry out the processing in a company, the data controller under the Law is, as a rule, the company’s legal entity.