Personal Data Protection Law
Personal Data Protection Law covers the legal regulations regarding the processing and protection of personal data of individuals. This area is of great importance in terms of ensuring the confidentiality of personal data, protecting the privacy rights of individuals and regulating the responsibilities of data processors. Here are the main points about the law on the protection of personal data:
1. Definition and Scope:
– Personal data is information that can be directly or indirectly associated with the identity of an individual (name, address, telephone number, IP address, etc.). The protection of personal data includes the processes of collecting, storing and processing this information.
2. Legal Framework:
– The protection of personal data in Turkey is regulated by the Law on the Protection of Personal Data No. 6698 (KVKK). This law clearly establishes data processing processes and the rights of interested parties.
– In Europe, the General Data Protection Regulation (GDPR) stands out as an important regulation and provides a broad framework for the protection of personal data.
3. Data Processor and Data Controller:
– Data Controller:* It is the natural or legal person who takes decisions regarding the processing of personal data and processes the data.
– Data Processor:* Persons or organizations that process personal data in line with the instructions of the data controller.
4. Processing of Personal Data:
– The processing of personal data includes processes such as collection, storage, modification, sharing and deletion. When processing data, certain legal grounds (such as approval, obligation, contract) must be provided.
5. Rights of the Data Owner:
– The law grants data subjects the following rights:
– Right of access to personal data
– Right to invalidation and deletion
– Right to request rectification
– Right to data portability
– Right to object to data processing
6. Data Security:
– In order to ensure the security of personal data, the data controller is required to take appropriate technical and administrative measures. In the event of data security breaches, effective response mechanisms must be established.
7. Transfer of Data Abroad:
– The transfer of personal data abroad becomes possible under certain conditions. The level of competence regarding the data security of overseas recipients should be considered.
8. Supervision and Penalties:
– In order to ensure the protection of personal data, personal data protection authorities have the authority to supervise. Administrative sanctions are imposed in case of data breaches and violations of the law.
9. Data Processing Agreements:
– Concluding contracts that determine the obligations of data processors to the data controller is critical to ensure data security.
10. Code of Ethics and Practices:
– Ethical principles for the protection of personal data should be determined and implemented. When companies respect users’ personal data, it increases user trust.
Personal Data Protection Law has become increasingly important with the increase in digitalization and data sharing. The regulation of this area is of great importance in terms of protecting the privacy of individuals, ensuring data security and respecting personal data.
In the Turkish Penal Code, the crimes that can be committed, especially in relation to personal data, and their penalties are as follows:
Crime of recording personal data Article 135- (1) A person who unlawfully records personal data is sentenced to imprisonment from one year to three years. (2) Personal data is based on the political, philosophical or religious views of individuals, racial origins; In the event that it is unlawfully related to their moral inclinations, sexual life, health status or trade union affiliations, the penalty to be imposed in accordance with the first paragraph shall be increased by half.
Crime of unlawfully giving or obtaining data Article 136- (1) A person who unlawfully gives, disseminates or seizes personal data to another person is punished with imprisonment from two years to four years. (2) (Added: 17/10/2019-7188/17 art.) If the subject of the offense is statements and images recorded in accordance with the fifth and sixth paragraphs of Article 236 of the Code of Criminal Procedure, the penalty to be imposed is increased by one fold.
Qualified cases Article 137- (1) Crimes defined in the above articles;
By a public official and by abusing the authority conferred by his office,
By taking advantage of the convenience provided by a certain profession and art, If committed, the penalty to be imposed is increased by half.
Crime of not destroying data Article 138 – (1) Those who are obliged to destroy the data within the system despite the expiry of the periods determined by the laws are sentenced to imprisonment from one year to two years when they fail to fulfill their duties. (2) (Added: 21/2/2014-6526/5 art.) If the subject of the crime is data that must be eliminated or destroyed in accordance with the provisions of the Code of Criminal Procedure, the penalty to be imposed is increased by one fold.
If the non-fulfillment of these obligations constitutes a tort and causes damage, it will also provide the opportunity to file a lawsuit for compensation to the relevant persons, if the conditions are met within the scope of the general provisions.
Since the obligations specified in the legislation are mandatory for all data controllers, it is of great importance for data controllers to continue their activities in accordance with the legislation and to manage the KVKK compliance processes with the support of the experts.
As Terlemez Law Firm, we provide professional services to our domestic and foreign clients within the scope of Personal Data Protection law with our expert lawyer staff.
