Evaluation Of The Announcement Regarding The Covid-19 PCR Test Result and Vaccine Information Application By The Personal Data Protection Board 01 October 2021

After qualifying the personal data processed in the procedure, the Board stated that considering the effects of the Covid-19 pandemic on worldwide health, social life and economy; the processing of personal health data related to Covid-19, such as vaccination status and PCR test result, is for the purpose of protecting public health, public safety, and public order.

Considering The Feature Of The Process, Is It Possible Not To Apply The Law?

Recognizedly, the first paragraph of Article 28 of the Law determines the personal data processing activities which the Law will not be implemented to and will be out of scope. It is stated In the sub-article (ç) of the relevant paragraph that, in case "the personal data is processed within the scope of preventive, protective and informative activities carried out by public institutions and organizations that have been authorized by law to ensure national defense, national security, public safety, public order or economic security" provisions are not applicable.

From this point forth, the Board also marked that the processing of personal data within the scope of activities carried out by authorized public institutions and organizations should be evaluated within the scope of sub-article (ç) of the first paragraph, in order to prevent the contagiousness of the epidemic to eliminate this threat in cases such as epidemics that threaten public security and public order.

In summary, the Board expressed the opinion that the law will not be applicable in the procedure of processing the personal data of the relevant people by requesting the Covid-19 vaccine and PCR test information from these people within the scope of the Covid-19 epidemic in order to prevent the spread of the disease due to the fact that the epidemic caused by Covid-19 threatens public security and public order.

What are the Limits of Conditions Which the Law Will Not Apply?

The Board has determined that the Law will not be applied in the processing of Covid-19 vaccine and/or negative PCR test information if only it is done by authorized public institutions and organizations in order to prevent the spread of the disease and because the epidemic disease caused by Covid-19 threatens public security and public order. Apart from this, The Board stated that personal data processing activities, other than or exceeding the activities for the purpose of protecting public security and public order carried out within the scope of the Covid-19 epidemic, will be covered by the Law. In other words, in case of a change in the data processing activity, the Law will be applicable, and the obligations of the data controller to inform and obtain consent as a part of special data processing activities will be reactivated.

Will The Law Not Be Applied In Cases Where The Data Controller Is A Natural Or Artificial Person by the Private Law?

It has clearly stated by the Board that the Law will not be applicable in the processing of Covid-19 vaccine information and/or negative PCR test information by the data controller, who is a natural or an artificial person by the private law, to prevent the spread of the disease because of the fact that the epidemic disease caused by Covid-19 threatens public security and public order. However, in the decision taken by the Board, references were made to the circulars of the Ministry of Internal Affairs and the Ministry of Labor and Social Security, and in the cited circulars, there are not only authorized public institutions and organizations among the data controllers that will be involved in data processing.

In this context we would like to point out that, in line with the information conveyed by the Board officials, in order to prevent the spread of the disease due to the epidemic conditions caused by Covid-19 threatening public security and public order; in case the Covid-19 vaccine information and/or negative PCR test information  is submitted to the data controllers (such as commercial enterprises, trading companies, cooperatives, etc.) other than authorized public institutions, the Law will also not be applicable. However, since the reference provision shown in the Decision is a highly controversial regulation, we expect an additional explanation from the Board on this issue.