The Board of Protection of Personal Data Has Published New Decisions 10 April 2020
The Board of Protection of Personal Data Has Published New Decisions
Pursuant to Articles 15 and 22 of the Law on Protection of Personal Data No. 6698 (the “Law”), the Board of Protection of Personal Data (the “Board”) is entitled to conduct necessary inspections within the scope of its remit, either ex officio in case it learns independently of possible violations or upon complaint, and to impose administrative fines in cases of breach. The Board publishes, on its website, summaries of its post-investigation decisions, which are considered to be important and to establish precedents.
We hereby present summaries of several of these Board decisions.
Board Decision No. 2019/138, about unlawful access of an employee’s WhatsApp correspondence by a company owner, published on 16.05.2019 by the Board
Pursuant to a complaint made to the Board related to the claims about the unlawful obtaining of employee WhatsApp correspondence, which was subsequently shared with third parties, the Board initiated an investigation.
After the investigation, the Board concluded when an employer reads the correspondence of an employee made through the employee’s computer at the workplace, taking photos and/or screenshots, the employer has committed a crime under Turkish
Criminal Law No. 5237; when so deciding, the Board observed the complaint cannot be evaluated pursuant to Articles 15/1 and 15/2 of the Law, which provides the Board
is to make the necessary examination of alleged violations of the Law are it learned of them upon receiving a complaint, when complaint does not meet the requirements set forth in Article 6 of the Law on the Use of Right to Petition. In its decision, the Board found that the employer’s WhatsApp user is not a data controller, and reading the correspondence, taking photos and saving screenshots cannot be considered data processing.
Board Decision No. 2019/106, about claims that an intermediary service provider’s website requires visitors to log in and does not allow them to
proceed to homepage without filling in -mail section asking for their email addresses, published on 08.07.2019 by the Board
In a complaint made to the Board, the complainant alleged that an intermediary service provider’s website requires its visitors to log in and does not allow them to proceed to homepage without first providing their e-mail addresses, which means the provision of personal data is a condition for the use of service, with legal bases for processing the personal data not clearly stated in the data processing notice.
As a result of its examination, the Board found that offering or making utilization of a product or service conditioned on the provision of personal data violated the explicit consent requirement, i.e., the rule requiring that explicit consent be an exercise of free will. Although the website subject to the review does not appear to be a direct supplier/provider of goods and services, the Board observed the site acts as an intermediary service provider, allowing the purchase of various services offered by a variety of service providers in other locations, and in different sectors. In this regard, however, based on the Board’s assessment that the discounted prices and advantages offered within the website are only offered to its members, rather than being the provision or utilization of a product or service provided pursuant to explicit consent, the Board decided there is no action to be taken under the Law regarding the subject matter.
In addition, when text on the website, titled “Our Privacy and KVK Policy”, , was examined by the Board within the framework of the “relevant legislation” , the Board observed it had not been specified whether the personal information processed by the website was processed within the framework of the obligations arising under that legislation or was based on the explicit consent of the relevant persons, or what part of the personal data in question was processed in accordance with any such explicit consent . In this context, the Board concluded if the personal data processing activity was based on anything other than the explicit consent provided for in the Law, there would be no need to obtain explicit consent from the person concerned, as that would be deceptive and a misuse of the explicit consent requirement. As a matter of fact, it must be emphasised that, if the explicit consent of the relevant person is withdrawn, it would mean the data controller who continues the data processing activity of the personal information in question based on one of the other personal data processing conditions, would be violating the Law.
The Board decided to instruct the website to update the text of its “Privacy and KVK Policy” by taking into account the provisions found in the “Communique on Principles and Procedures to be Followed in Fullfillment of the Obligation to Inform” and the website’s obligation to properly inform and obtain explicit consent. As the Board has stated in many resolutions, the provisions on websites related to privacy must be written clearly and understandable, as well as being as short and concise as possible, and most importantly be in accordance with the Law, including the obligation to use titles such as “KVKK Information Text”, “Our KVKK Policy”, and “Privacy and Information about KVKK”.. IN other words, the Board has made it clear that privacy relate notices should be presented to the relevant persons in a clear, simple and understandable manner, and in accordance with the provisions of the Law and related secondary legislation.
Board Decision No. 2019/273, on the requests of relatives to access their deceased ones’ personal data, published on 18.09.2019 by the Board
In an appeal made to the Board by the spouse of the deceased, the living spouse requested medical records and other information of the deceased spouse from a medical clinic by registered letter with return receipt. However, the clinic did not answer. Thereupon, the spouce forwarded an e-mail containing the aforementioned requests to the clinic's electronic address, after which the request was rejected by the clinic, which stated it could not share such information in absence of an official request. The living spouse then /she appealed to the Board for access to the personal data of the deceased spouse.
The Board considered Article 3 of the Law , and determed the relevant person is defined as “real person whose personal data is processed” and decided the living spouse’s request would not qualify be considered as a request under Article 11 of the Law, since the requested personal data was not related to the living spouse and, instead, belongs to the deceased spouse. The Board took into consideration the provision in the definition of personal data regarding being related to the “real person”, and then considered the definition of personality set forth in the Civil Code, which provides personality begins with birth and ends at death, it conluded the personal data of deceased persons cannot be considered as personal data within the scope of the Law, and the rights specified in Article 11 of the Law cannot be utilized.
WHAT IS THE MONETARY LIMIT REGARDING THE SIMPLIFIED PROCEDURE APPLIED IN COMMERCIAL CASES?
The monetary limit on commercial cases subject to the simplified trial procedure has been rearranged with the Law No. 7251, which entered into force on 28.07.2020. What does this amendment bring to our procedural law?
AFTER SALES SERVICES REGULATION, INTRODUCTION AND USER MANUAL REGULATION AND WARRANTY CERTIFICATE REGULATION HAVE BEEN CHANGED
THE PRELIMINARY INJUCTION AND PRECAUTIONARY ATTACHMENT WHICH ARE PRONOUNCED IN THE PRESENCE OF PARTIES
Is it possible to apply for an appeal within the framework of the new HMK against the preliminary injunction and precautionary attachment decisions which are pronounced in the presence? What has changed with the new HMK?
WHAT ARE THE AMENDMENTS INTRODUCED REGARDING THE “SUBMISSION AND EVIDENTIALITY OF COMMERCIAL BOOKS?
WHAT DOES THE NEW HMK SAY ABOUT "AMENDMENT OF PLEADING AFTER THE REVERSAL"?
A groundbreaking change has taken place that will put an end to the controversies that have been going on for decades regarding the "Amendment of Pleading After Reversal Decision" regulation of the HMK. In this newsletter, we are going to examine what the new regulation brings.
THE GUIDELINE ON EXAMINATION OF DIGITAL DATA DURING ON-SITE INSPECTIONS IS PUBLISHED
WHAT ARE THE CHANGES INTRODUCED REGARDING THE "EXTENSION AND CHANGE OF CLAIMS AND DEFENSE" IN THE CODE OF CIVIL PROCEDURE NUMBERED 6100 WITH THE LAW NO. 7251?
The amendments brought to the Code of Civil Procedure in terms of “the Extension and Change of the Claims and Defense” is examined with our newsletter this week.
REVIEW ON THE DRAFT COMMUNIQUE ON REMOTE IDENTIFICATION METHODS TO BE USED BY BANKS
WHICH AMENDMENTS HAVE BEEN MADE TO THE REGULATION RELATED TO THE PROCEDURES AND PRINCIPLES OF THE GENERAL ASSEMBLY MEETINGS OF JOINT STOCK COMPANIES?
A significant amendment has been made within the scope of The Regulation on the Amendment to the Regulation Related to the Procedures and Principles of the General Assembly Meetings of Joint Stock Companies and Representatives of the Ministry of Customs and Trade to Attend These Meetings published in the Official Gazette dated 09.10.2020 and numbered 31269. We will examine what the new regulation brings.
WHAT ARE THE AMENDMENTS INTRODUCED REGARDING THE "COLLATERAL LIMITATION (EXTENSION OF TIME) TO THE RESPONSE PERIOD" IN THE CODE OF CIVIL PROCEDURE NUMBERED 6100?
With Law No.7251, which entered into force on 28.07.2020, a significant amendment has been made regarding the regulation of “Collateral Limitation to the Response Period (Time Extension) in the Code of Civil Procedure. In this newsletter, we will examine what the new regulation brings.
“UNSPECIFIED CLAIM CASE” UNDER THE LIGHT OF THE RECENT AMENDMENTS IN THE CODE OF CIVIL PROCEDURE (“CCP”)
As it is known with Law No.7251, which entered into force on 28.07.2020, many radical changes in procedural law have entered our lives.
SHORT NOTES ON THE DIGITALIZING MUSIC INDUSTRY AND THE RESHAPING REQUIREMENT OF THE COPYRIGHT CONTRACTS
The world music industry is reshaping with the pandemic!
ORDINARY MEETING OF THE GENERAL ASSEMBLY OF COOPERATIONS AND SUPERIOR ORGANISATIONS HAVE BEEN POSTPONED
HOW HAS THE PANDEMIC AFFECTED THE LOSS OF PROFIT POLICIES?
In the new world order brought by the COVID-19 epidemic, many institutions have been reshaped. It is inevitable that the insurance law will be transformed in the new world order.
LEGAL RESULTS OF CONTRARIETY TO THE PROHIBITON OF TERMINATION
What is the meaning of the amendment made with the Law numbered 7244, which has been added to the Labor Law No. 4857?