Recently the Turkish Data Protection Board (“Board”) has issued a number of decisions, many of which particularly interest businesses and legal practices. In this article, you may kindly find our evaluations of Board decisions regarding the protection and maintaining of personal data, the necessity of a legitimate reason for data processing, and the principle of relevance and proportionality.

You can access the full text versions of the decisions via this link.

I. Protection and processing of personal data of a specific nature within the context of relevance and proportionality

In our first decision to review, two companies operating gyms argued that they wanted to use biometric palm scanning systems to keep track of customer access to their facilities. Being concerned about the full protection of this sensitive data, the claimants made a notification to the Board. In response, the Board deemed the collected palm data as being of a specific nature, and it evaluated the processing in the context of relevance and proportionality. Because it stressed that the processing of data must be relevant with, limited to and proportionate to its purpose, the Board stated that the methods used were inappropriate and unfit for the task performed; instead, simpler methods of processing should be used.

In addition, the Board concluded that, in order to benefit from the facilities of the gyms, customers were asked to give their explicit consent, which is known to impair the genuineness of the consent.

In light of these points, the Board issued administrative fines to the data controllers for their disproportionate and inappropriate practice, and also for not complying with the rules which set out the conditions for proper acquisition of consent. The companies were also instructed to halt the use of biometric systems immediately and opt for simpler methods. Moreover, controllers were obligated to destroy any information acquired by these systems, and to notify any third party that might have acquired such data to do the same.

Last but not least, the Board reached the opinion that allowing third persons to observe personal information by displaying gym members’ photos and last entrance times in a public place showed that adequate administrative and technical precautions were not implemented. Thus, an additional penalty was issued against the controllers.

II. Data processing activities should be based on solid legal grounds

In another decision, it was alleged that text messages containing advertisements were sent to the claimant’s mobile phone by the data controller. The data subject, who had no idea about the source providing his personal information to the data controller, eventually appealed to the Board about the matter, after not receiving a response from the data controller himself. As this implied no explicit consent was collected from the data subject, the Board ruled that data processing activity such as sending messages to a person’s mobile phone does indeed require consent or other identified legal grounds to fully comply with the law.

Consequently, an administrative fine of TRY50,000 was imposed against the data controller.

III. Beware of using Gmail for your corporate emails!

In this case where the Board’s opinion was requested, it was stated that “the use of corporate emails via Gmail means that the personal data will be stored on the centers abroad, where Google’s servers are located”. Henceforth, it would be obligatory to comply with Article 9 of the Law on the Protection of Personal Data (“Law”).

Likewise, corporations that utilise storage technologies (like cloud) from service providers who have their data servers installed in third countries should also take heed of this decision. Therefore, we advise that such corporations should take the necessary steps to bring their compliance levels up to standard.

IV. Think twice when sending personal data: data security breaches by sending someone else’s information to a person’s mobile phone

In another recently published decision, it was stated that a data controller, who was an attorney working on a debt enforcement case, violated the debtor’s personal data security. The attorney sent to the claimant, who is the uncle of the debtor, personal information about the debtor, such as his name and service number. As a result, the attorney as a data controller was given a TRY50,000 administrative fine.

V.Sending multiple text messages regarding the same matter to a data subject represents an abuse of rights

In this decision, the data controller was an asset management company, and the claimant, who was the data subject, failed to pay back his loans. The asset management company, which took over these receivables in agreement with the bank, sent text messages to the data subject in order to protect its rights in accordance with the law.

As the asset management company sent these text messages to the data subject more than once, the Board interpreted it as an abuse of rights. Consequently, the Board fined the company TRY20,000 for breaching the principle of compliance with the law and acting in good faith.

Conclusion

We believe that the Board decisions contain very important messages for data controllers. In this context, we would like to remind you that it is highly important to take the necessary precautions to ensure the security of personal data, especially when it comes to sensitive data; and that it is a crime under the Turkish Penal Code to obtain personal data without getting the explicit consent of the data subject.

In addition, it is clear that the Board places a great deal of importance on the legal grounds for processing data; therefore it is crucial for data controllers to comply with Article 5 of the law regarding processing of personal data. Finally, yet significantly, we would like to remind you that data controllers need to fully comply with the obligations set out in Article 9 if they wish to utilise mail or storage services from providers which are established abroad.

Read the full article