Under the Law No. 6698 on the Protection of Personal Data ("Law"), one of the legal grounds that makes it possible to process personal data without seeking explicit consent is the condition of "being stipulated by law".
The Personal Data Protection Board ("Board") has published an information note ("Information Note") on the requirement of "'stipulated by law" and made some explanations about the basis of this legal reason within the scope of data protection legislation.
- What is the "'stipulation in law" condition?
Pursuant to Article 5 of the Law, as a rule, personal data cannot be processed without explicit consent. However, in the presence of one of the conditions listed in the continuation of the article, it is possible to process personal data without seeking the explicit consent of the data subject. One of these conditions is the condition of "explicitly stipulated in the law" subject to the Authority's Information Note.
In the justification of the Law published by the Board, it is stated that explicit consent is not required in cases such as taking fingerprints of suspects in accordance with the Law on the Duties and Powers of the Police due to a criminal investigation by the law enforcement agency, and the Ministry of Justice processing the data of individuals regarding criminal convictions in accordance with the Law on Judicial Registry.
- Assessments within the Scope of the Information Note
In the Information Note, it is emphasized that, within the scope of Article 20 of the Constitution, if there is an explicit provision in any law or if an explicit provision is directed to secondary legislation, personal data may be processed without explicit consent, but it is not possible to limit the right to protection of personal data in the Constitution only by statute, regulation or any other administrative act.
In this respect:
- in order for personal data to be processed without explicit consent based on the legal reason of "being stipulated in the law", there must be a law provision requiring the processing of personal data; and
- in cases where the general framework of the processing of personal data is outlined by law, but the details are regulated by regulations etc., it is stated that the reason of ""stipulated by law" can be relied upon.
As an example, it is pointed out that the main basis for the processing of consumer data within the scope of the conclusion of distance contracts is included in the Law on the Protection of Consumers, but the issue of which data of the consumer will be processed within the scope of the distance contract is regulated in more detail in the Regulation on Distance Contracts, and in this framework, the reason "stipulated by law" will be applied in terms of the seller's processing of consumer data.
In addition, an assessment was also made in the Information Note within the scope of the General Data Protection Regulation ("GDPR"). It is stated that, unlike the Law, the GDPR does not distinguish between being expressly provided for by law and the fulfillment of a legal obligation, and pursuant to Article 41 of the Preamble of the GDPR, a legal obligation may be considered as a condition for processing if it refers to a specific provision of law or can be identified by pointing to sources such as advice, guidance, etc. that clearly set out its application.
Also, by referring to a guideline of the Irish Data Protection Authority, it is stated that data controllers should clearly point out the specific law, recommendation, board or court decision, case law or guideline that gives rise to the legal obligation requiring processing. In this context, it is understood that the Board has also taken into account the criteria for the application of the "fulfillment of a legal obligation" reason in the GDPR in terms of the interpretation of the "'stipulated by law" reason in the Law.
You can access the full text of the Information Note (in Turkish) from the link below:
https://kvkk.gov.tr/SharedFolderServer/CMSFiles/8d119dab-5886-4300-bd13-4eaf9bf15ea0.pdf
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.