Personal data

Scope

The Law applies to natural persons whose personal data is processed and to natural and legal persons who process this data wholly or partly by automated means, or by non-automated means provided that it forms part of a data filing system (Art. 2). For information to be regarded as personal data, the person’s identity does not necessarily have to be known; it is sufficient that the person is identifiable. Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, constitute special categories of personal data and are subject to stricter processing conditions (Art. 6). Data that has been anonymized loses its character as personal data because it cannot be linked to a person even if matched with other data (Art. 3/1-b). The Law does not apply in the cases listed in Article 28, such as activities of natural persons relating solely to themselves or to family members living in the same household, provided that the data is not disclosed to third parties and data security obligations are complied with, or anonymized statistics.

Practical significance

Persons and organizations that process personal data are obliged to comply with general principles such as compliance with the law and good faith, accuracy, being limited to specified and legitimate purposes, and proportionality (Art. 4), to rely on one of the processing conditions in the Law (Art. 5, 6), to inform the data subject (Art. 10) and to take data security measures (Art. 12). The data subject exercises the rights in Article 11 by first applying to the data controller; the application is, as a rule, concluded within thirty days at the latest, after which the route of a complaint to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) opens (Art. 13, 14). Violations of the Law may lead to an administrative fine (Art. 18), and the unlawful recording, disclosure to others or obtaining of personal data may constitute the offenses in Articles 135–136 of the Turkish Penal Code.

Commonly confused concepts

Not every item of personal data is special categories of personal data; special categories are listed exhaustively in Article 6 and their processing is subject to stricter conditions. Personal data should also not be confused with anonymous data: a record in which only the name has been deleted but which is capable of re-identifying the person when matched with other data is not regarded as anonymous. Personal data is also a separate concept from the “data subject” to whom the data belongs and from the data controller, who determines the purposes and means of processing.