Until April 2016 there was no framework law in Turkish law governing privacy and the protection of personal data. With the new law, natural and legal persons are not allowed to share or process personal data with third parties without the explicit consent of the related person.
Recently in Turkey, Law No 6698 titled Protection of Personal Data (Kisisel Verilerin Korunması Kanunu, hereafter: KVKK) was published on 07.04.2016 in the Turkish Official Gazette number 29677. According to this law, natural and legal persons are not allowed to share or process personal data with third parties without the explicit consent of the related person. Before the KVKK was published, privacy and the protection of personal data was only regulated in article 20 of the Turkish Constitution. Under this article, everyone can ask for protection of his or her personal information. This right includes the right to be informed about your own personal information, to get access, to change, to request this data be deleted and to be informed whether this personal information is used and processed for right purposes or not.
Although this article states that the procedures regarding the protection of personal data are regulated by law, until April 2016 there was still no framework law or any other regulations in the Turkish law. This led to ambiguities in the implementation and the procedures to be followed with respect to data protection. In short, this fundamental right could not be exercised. With the new KVKK the scope of data protection is expanded and the principles and procedures for the processing of personal data are described.
The KVKK aims to protect personal data, in particular the privacy and the fundamental rights and freedoms of individuals. In addition, the KVKK regulates the principles and procedures regarding the use of personal data by natural and legal persons. In the KVKK, personal data is defined as any information relating to a real person’s ID. A destinction is also made between personal data and private personal data. By personal information are meant your name, birthplace, ID number, tax number etc. Private personal information is information about your religion, race, political thoughts, ethnicity etc.
According to Article 5 of the KVKK natural and legal persons cannot share and process personal data with third parties without the explicit consent of the person. In some conditions, mentioned in article 5 paragraph 2, it is possible to share and process personal information without the explicit consent of the person.
These conditions are:
a) clearly provided by law
b) If it is impossible for the person to give his/her explicit permission to share his/ her personal information with third parties, for example if he or she has no legal capacity (is incapable) to protect his/her life or physical integrity.
c) When it is needed for the establishment or performance of a contract to process personal information.
d) If processing personal information is needed to fulfill the legal obligations.
e) If the personal information is made public by the person him- or herself.
f) If processing personal information is necessary for using or protection of a right.
g) If processing personal information is needed in the legitimate interest of the person or legal entity responsible for the data without violating the fundamental rights and the freedom of the persons.
According to article 9 KVKK, transferring personal data abroad is also not allowed and explicit consent is necessary. The Turkish government will monitor whether there is adequate protection of the personal data transferred to third countries. If there is not enough protection, those responsible for data protection in Turkey and the other country have to make a written agreement that they will protect the transferred data adequately. The Personal Data Protection Board has to give its permission, too. This board will publish a list of countries which can give adequate protection for personal information. This board has the competence to decide if there is enough protection in a country. This decision depends on international treaties, relations between Turkey and the other country, the purpose of the processing and its duration etc. If the interests of Turkey in the related person will be seriously damaged, the personal information can just be transferred with the explicit permission of the related public institution or the board. It is important to know that articles 8, 9, 11, 13, 14, 15, 16, 17 and 18 of the KVKK will enter into force 6 months after the law is published. The other articles are already in force.
Turkish law also provides limited legal protection for taxpayers in international relations. There is no specific law or article which regulates the legal protection of taxpayers’ rights during exchange of information procedure between tax authorities. The international exchange of information is only regulated in double taxation agreements and in Turkish national law only in article 152/A of the Turkish Tax Procedure Law (Vergi Usul Kanunu) and article 12 Law number 5549 to Prevent the Laundering of Criminal Proceeds. The KVKK will ensure that there will be better protection of personal data, also for taxpayers.
“Until April 2016 there was no framework law with respect to data protection. This led to ambiguities in the procedures to be followed.”
Zehra Isıksoy tax law consultant, Ecovis, Istanbul, Turkey
Recently in Turkey, Law No 6698 titled Protection of Personal Data (Kisisel Verilerin Korunması Kanunu, hereafter: KVKK) was published on 07.04.2016 in the Turkish Official Gazette number 29677. According to this law, natural and legal persons are not allowed to share or process personal data with third parties without the explicit consent of the related person. Before the KVKK was published, privacy and the protection of personal data was only regulated in article 20 of the Turkish Constitution. Under this article, everyone can ask for protection of his or her personal information. This right includes the right to be informed about your own personal information, to get access, to change, to request this data be deleted and to be informed whether this personal information is used and processed for right purposes or not.
Although this article states that the procedures regarding the protection of personal data are regulated by law, until April 2016 there was still no framework law or any other regulations in the Turkish law. This led to ambiguities in the implementation and the procedures to be followed with respect to data protection. In short, this fundamental right could not be exercised. With the new KVKK the scope of data protection is expanded and the principles and procedures for the processing of personal data are described.
The KVKK aims to protect personal data, in particular the privacy and the fundamental rights and freedoms of individuals. In addition, the KVKK regulates the principles and procedures regarding the use of personal data by natural and legal persons. In the KVKK, personal data is defined as any information relating to a real person’s ID. A destinction is also made between personal data and private personal data. By personal information are meant your name, birthplace, ID number, tax number etc. Private personal information is information about your religion, race, political thoughts, ethnicity etc.
According to Article 5 of the KVKK natural and legal persons cannot share and process personal data with third parties without the explicit consent of the person. In some conditions, mentioned in article 5 paragraph 2, it is possible to share and process personal information without the explicit consent of the person.
These conditions are:
a) clearly provided by law
b) If it is impossible for the person to give his/her explicit permission to share his/ her personal information with third parties, for example if he or she has no legal capacity (is incapable) to protect his/her life or physical integrity.
c) When it is needed for the establishment or performance of a contract to process personal information.
d) If processing personal information is needed to fulfill the legal obligations.
e) If the personal information is made public by the person him- or herself.
f) If processing personal information is necessary for using or protection of a right.
g) If processing personal information is needed in the legitimate interest of the person or legal entity responsible for the data without violating the fundamental rights and the freedom of the persons.
According to article 9 KVKK, transferring personal data abroad is also not allowed and explicit consent is necessary. The Turkish government will monitor whether there is adequate protection of the personal data transferred to third countries. If there is not enough protection, those responsible for data protection in Turkey and the other country have to make a written agreement that they will protect the transferred data adequately. The Personal Data Protection Board has to give its permission, too. This board will publish a list of countries which can give adequate protection for personal information. This board has the competence to decide if there is enough protection in a country. This decision depends on international treaties, relations between Turkey and the other country, the purpose of the processing and its duration etc. If the interests of Turkey in the related person will be seriously damaged, the personal information can just be transferred with the explicit permission of the related public institution or the board. It is important to know that articles 8, 9, 11, 13, 14, 15, 16, 17 and 18 of the KVKK will enter into force 6 months after the law is published. The other articles are already in force.
Turkish law also provides limited legal protection for taxpayers in international relations. There is no specific law or article which regulates the legal protection of taxpayers’ rights during exchange of information procedure between tax authorities. The international exchange of information is only regulated in double taxation agreements and in Turkish national law only in article 152/A of the Turkish Tax Procedure Law (Vergi Usul Kanunu) and article 12 Law number 5549 to Prevent the Laundering of Criminal Proceeds. The KVKK will ensure that there will be better protection of personal data, also for taxpayers.
“Until April 2016 there was no framework law with respect to data protection. This led to ambiguities in the procedures to be followed.”
Zehra Isıksoy tax law consultant, Ecovis, Istanbul, Turkey
