The protection of personal data is the discipline of the processing of personal data and the protection of fundamental rights and freedoms.
The protection of personal data basically aims to protect the persons to whom this personal data is related, not the data. In other words, data protection; It refers to the administrative, technical and legal measures aimed at protecting individuals from damages arising from the fully or partially automatic or non-automatic processing of the data about them and embodied in the principles regarding the protection of personal data. In this sense, it can be said that the protection of personal data aims to restore the right of control to individuals, covering all stages of data processing processes such as the collection, storage, use and transfer of personal data. Within the scope of this purpose, the protection of personal data means the right of the individual to determine the future of his data himself. At the same time, this protection is a requirement of human dignity and personality right.
WHAT ARE THE LEGAL REGULATIONS REGARDING THE PROTECTION OF PERSONAL DATA IN OUR COUNTRY? The right to the protection of personal data has been guaranteed by the constitution in 2010 in our country. Until this date, personal data was mostly protected by the provisions in the general legal regulations. Provisions and sanctions on the right to personality and the protection of personal data in the Turkish Civil Code and the Turkish Penal Code can be given as examples of these regulations. In 2010, the protection of personal data gained the status of a constitutional right for the first time, with the provision "Everyone has the right to demand the protection of personal data regarding himself..." added to Article 20 of the Constitution. At the same time, determining the procedures and principles regarding the protection of this right in the 3rd paragraph of Article 20 of the Constitution is left to a law to be enacted. In this context, Law No. 6698 on the Protection of Personal Data, adopted on March 24, 2016, entered into force by being published in the Official Gazette dated April 7, 2016 and numbered 29677.
WHAT IS THE SCOPE OF THE RIGHT TO REQUEST THE PROTECTION OF PERSONAL DATA AS A CONSTITUTIONAL RIGHT? With the amendment made in 2010 with the Law No. 5982, Article 20 of the Constitution, which regulates the privacy of private life, states, “Everyone has the right to demand the protection of their personal data. This right; It also includes being informed about the personal data about the person, accessing these data, requesting their correction or deletion, and learning whether they are used for their purposes. Personal data can only be processed in cases stipulated by law or with the explicit consent of the person. The principles and procedures regarding the protection of personal data are regulated by law. The scope of the right of individuals to protect their personal data has been determined by adding the provision.
WHY IS THERE A NEED FOR A LEGAL REGULATION ON THE PROTECTION OF PERSONAL DATA? Both public institutions and private organizations have been processing personal data for a long time in connection with the fulfillment of a task or the provision of a service. This situation may arise from laws, sometimes based on the consent of individuals or a contract, and sometimes depending on the nature of the transaction. It should be noted that the protection of fundamental rights and freedoms of individuals in the data processing process is one of the priority issues.
In addition, although it is inevitable to process personal data in order to maintain social and economic life in an orderly manner, to provide public services effectively, to develop, distribute and market goods and services in accordance with the requirements of the economy, unlimited and arbitrary collection of personal data, making it accessible to unauthorized persons, disclosure It is necessary to prevent the violation of personal rights as a result of misuse or misuse.
In addition, the Convention No. 108 on the Protection of Individuals Against Automatic Processing of Personal Data, which was prepared by the Council of Europe in order to protect personal data at the same standards in all member countries and to determine the principles of cross-border data flow, was opened for signature on 28 January 1981 and signed by our country. This contract was published in the Official Gazette dated 17 March 2016 and numbered 29656 and included in the domestic law. Within the framework of Article 4 of the Convention No. 108, it has become necessary to make legal arrangements for the protection of personal data in domestic law. As a matter of fact, in the decision of the Constitutional Court dated 9 April 2014 and numbered E:2013/122, K:2014/74; It has been determined that “the right to protection of personal data, as a special form of the protection of the human dignity of the person and the right to freely develop his personality, aims to protect the rights and freedoms of the individual during the processing of personal data [...] It has been stated that personal data is in need of protection much more than in the past, due to factors such as the risks created by private sector elements reaching more widespread and significant dimensions, and the increase in the activities of terrorist and criminal organizations to seize personal data.
WHAT IS THE BASIS OF THE RIGHT TO PROTECT PERSONAL DATA? IS THIS RIGHT AN UNLIMITED RIGHT? The basis of the right to protection of personal data is the last paragraph of Article 20 of the Constitution. The right to demand the protection of personal data, which is regulated as a fundamental right, is included in the section of the Constitution on the rights and duties of the individual. However, as with all rights and freedoms, the right to protect personal data may be limited in favor of other rights and freedoms within the limits drawn in the Constitution. Accordingly, regulations regarding the implementation of each right regarding the protection of personal data, as defined in Article 20 of the Constitution, and its limitation in favor of other rights, can only be made through law. In its decision dated April 9, 2014 and numbered E:2013/122, K:2014/74, the Constitutional Court also included the provision that "Principles and procedures regarding the protection of personal data are regulated by law" in the last sentence of the 3rd paragraph of Article 20 of the Constitution, and "legislative In accordance with the principle of “the inalienability of its power”, it has been decided that the executive body cannot be given the authority to take direct and first-hand regulatory actions in the matters that the Constitution clearly envisages to be regulated by law, and underlined that the legal regulation envisaged in the Constitution must be carried out. Therefore, the regulations regarding the right to protection of personal data, which are recognized in the last paragraph of Article 20 of the Constitution, will be applicable as long as they are made by law. KİŞİSEL VERİLERİN KORUNMASI KANUNU NE ZAMAN YÜRÜRLÜĞE GİRMİŞTİR? Kişisel Verilerin Korunması Kanunu Tasarısı, 6698 sayılı Kişisel Verilerin Korunması Kanunu adı ile 18 Ocak 2016 tarihinde TBMM Başkanlığına sevk edilmiş, 24 Mart 2016 tarihinde TBMM Genel Kurulu tarafından kabul edilerek kanunlaşmış ve 7 Nisan 2016 tarihli ve 29677 sayılı Resmi Gazetede yayımlanarak yürürlüğe girmiştir.
WHAT IS THE PURPOSE OF THE LAW ON PROTECTION OF PERSONAL DATA? With the Law, which was prepared by taking into account international documents, comparative law practices and the needs of our country, it is aimed to process and protect personal data in contemporary standards. In this context, the purpose of the Law is to regulate the conditions for the processing of personal data, the protection of fundamental rights and freedoms of individuals in the processing of personal data, the obligations of natural and legal persons who process personal data, and the procedures and principles to be followed. In the justification of the law, protecting the privacy of the individual and ensuring data security are also evaluated within this scope. In addition, regulating the obligations of natural and legal persons processing personal data and the procedures and principles to be followed are among the objectives of the Law.
WHAT IS THE SCOPE OF THE PERSONAL DATA PROTECTION LAW? The law applies to natural persons whose personal data are processed, and to natural and legal persons who process this data fully or partially automatically or non-automatically, provided that they are part of any data recording system (registration system where personal data is processed by structuring according to certain criteria). In this respect, no distinction has been made in terms of organizations operating in the private sector and public institutions and organizations, and it has been adopted that the prescribed procedures and principles are applied for all institutions and organizations. Since natural persons whose data are processed are mentioned in the Law, everyone who has a legal capacity is within the scope of the Law.
WHAT ARE THE CONDITIONS THAT ARE NOT INCLUDED IN THE SCOPE OF THE LAW? The law does not apply to data processors without being a part of any data recording system.
Since the term "real persons whose personal data are processed" is used in the Law, legal entities whose personal data are processed are also excluded from the scope of this Law.
In Article 28 of the Law, cases that are completely or partially out of the scope are regulated. Full exceptions are set in paragraph 1 of this article, and partial exceptions are set in paragraph 2 of this article. In cases of complete exception, the Law will not be applicable at all, and in cases of partial exception, only some articles of the Law will not be applicable.
WHAT ARE THE CONDITIONS THAT ARE NOT INCLUDED IN THE SCOPE OF THE LAW?
The law does not apply to data processors without being a part of any data recording system.
Comments