The Board of Protection of Personal Data Has Published New Decisions 10 April 2020

Pursuant to Articles 15 and 22 of the Law on Protection of Personal Data No. 6698 (the “Law”), the Board of Protection of Personal Data (the “Board”) is entitled to conduct necessary inspections within the scope of its remit, either ex officio in case it learns independently of possible violations or upon complaint, and to impose administrative fines in cases of breach. The Board publishes, on its website, summaries of its post-investigation decisions, which are considered to be important and to establish precedents.

We hereby present summaries of several of these Board decisions.

Board Decision No. 2019/138, about unlawful access of an employee’s WhatsApp correspondence by a company owner, published on 16.05.2019 by the Board

Pursuant to a complaint made to the Board related to the claims about the unlawful obtaining of employee WhatsApp correspondence, which was subsequently shared with third parties, the Board initiated an investigation.

After the investigation, the Board concluded when an employer reads the correspondence of an employee made through the employee’s computer at the workplace, taking photos and/or screenshots, the employer has committed a crime under Turkish

Criminal Law No. 5237; when so deciding, the Board observed the complaint cannot be evaluated pursuant to Articles 15/1 and 15/2 of the Law, which provides the Board

is to make the necessary examination of alleged violations of the Law are it learned of them upon receiving a complaint, when complaint does not meet the requirements set forth in Article 6 of the Law on the Use of Right to Petition. In its decision, the Board found that the employer’s WhatsApp user is not a data controller, and reading the correspondence, taking photos and saving screenshots cannot be considered data processing.

Board Decision No. 2019/106, about claims that an intermediary service provider’s website requires visitors to log in and does not allow them to

proceed to homepage without filling in -mail section asking for their email addresses, published on 08.07.2019 by the Board

In a complaint made to the Board, the complainant alleged that an intermediary service provider’s website requires its visitors to log in and does not allow them to proceed to homepage without first providing their e-mail addresses,  which means the provision of personal data is a condition for the use of service, with legal bases for processing the personal data not clearly stated in the data processing notice.

As a result of its examination, the Board found that offering or making utilization of a product or service conditioned on the provision of personal data violated the explicit consent requirement, i.e., the rule requiring that explicit consent be an exercise of free will. Although the website subject to the review does not appear to be a direct supplier/provider of goods and services, the Board observed  the site acts as an intermediary service provider, allowing the purchase of various services offered by a variety of service providers in other locations, and in different sectors. In this regard, however, based on the Board’s assessment that the discounted prices and advantages offered within the website are only offered to its members, rather than being the provision or utilization of a product or service provided pursuant to explicit consent, the Board decided there is no action to be taken under the Law regarding the subject matter.

In addition, when text on the website, titled “Our Privacy and KVK Policy”, , was examined by the Board within the framework of the “relevant legislation” ,  the Board observed it had not been specified whether the personal information processed by the website was processed within the framework of the obligations arising under that  legislation or was based on the explicit consent of the relevant persons, or what part of the personal data in question was processed in accordance with any such explicit consent . In this context, the Board concluded if the personal data processing activity was based on anything other than the explicit consent provided for in the Law, there would be no need to obtain explicit consent from the person concerned, as that would be deceptive and a misuse of the explicit consent requirement. As a matter of fact, it must be emphasised that, if the explicit consent of the relevant person is withdrawn, it would mean the data controller who continues the data processing activity of the personal information in question based on one of the other personal data processing conditions, would be violating the Law.

The Board decided to instruct the website to update the text of its “Privacy and KVK Policy” by taking into account the provisions found in the “Communique on Principles and Procedures to be Followed in Fullfillment of the Obligation to Inform” and the website’s obligation to properly inform and obtain explicit consent. As the Board has stated in many resolutions, the provisions on websites related to privacy must be written clearly and understandable, as well as being as short and concise as possible, and most importantly be in accordance with the Law, including the obligation to  use titles such as “KVKK Information Text”, “Our KVKK Policy”, and “Privacy and Information about KVKK”.. IN other words, the Board has made it clear that privacy relate notices should be presented to the relevant persons in a clear, simple and understandable manner, and in accordance with the provisions of the Law and related secondary legislation.

Board Decision No. 2019/273, on the requests of relatives to access their deceased ones’ personal data, published on 18.09.2019 by the Board

In an appeal made to the Board by the spouse of the deceased, the living spouse  requested medical records and other information of the deceased spouse from a medical  clinic by registered letter with return receipt. However, the clinic did not answer. Thereupon, the spouce forwarded an e-mail containing the aforementioned requests to the clinic's electronic address, after which the request was rejected by the clinic, which stated it could not share such information in absence of an official request.  The living spouse then /she appealed to the Board for access to the personal data of the deceased  spouse.

The Board considered Article 3 of the Law , and determed the relevant person is defined as “real person whose personal data is processed” and decided the living spouse’s request would not qualify be considered as a request under Article 11 of the Law, since the requested personal data was not related to the living spouse  and, instead, belongs to the deceased spouse. The Board took into consideration the provision in the definition of personal data regarding being related to the “real person”, and then considered the definition of personality set forth in the Civil Code, which provides personality begins with birth and ends at death, it conluded  the personal data of deceased persons cannot be considered as personal data within the scope of the Law, and the rights specified in Article 11 of the Law cannot be utilized.