Data Subject Requests Under Turkish Data Protection Law
The Law on Protection of Personal Data w. no. 6698 (“DPL”) contains data subject rights that are similar to those that can be found in the General Data Protection Regulation. The data subject rights are stipulated under Art. 11 of the DPL and the rights available to data subjects are:
- to learn whether their personal data are processed or not,
- to demand for information as to if their personal data has been processed,
- to learn the purpose of the processing of their personal data and whether these personal data are used in compliance with the purpose,
- to know the third parties to whom their personal data is transferred in country or abroad,
- to request the rectification of the incomplete or inaccurate data, if any,
- to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7,
- to request reporting of the rectification, erasure and destruction operations carried out to third parties to whom their personal data have been transferred,
- to object against the results that may have occurred solely by analyzing the data through automated systems,
- to claim compensation for the damage arising from the unlawful processing of his/her personal data.
While certain rights are common, the exercise of the right under the DPL is subject to certain different requirements.
Conditions and Content for a Valid Data Subject Request
Under the Communiqué on The Procedures and Principles of Application to Data Controller dated March 10, 2018 (“Communiqué”), the rules related to exercise of data subject rights are determined.
Pursuant to the Communique prepared by the Turkish Data Protection Authority (“DPA”), all persons are entitled to apply to the controller to exercise their rights under the DPL, saved that the application to the controller must be in Turkish language.
Further, the Communique requires the following information to be present in data subject requests;
- Name, Surname (signature the application is made physically (in writing),
- For Turkish Citizens, TC identity number; for foreigners, nationality, passport number or identity number if available,
- Residential or business address which is available for the Data Controller to send a response to,
- E-mail address or telephone or fax number subject,
- The request itself.
Valid Methods to send a Data Subject Request
The Communiqué determines several methods for the data subject requests to be sent to the data controller. Therefore, data subject requests must be sent using any of the following methods to be valid:
- In writing (via notary public),
- KEP address (KEP is a registered e-mail system which allows id verification),
- Secure electronic signature or mobile signature,
- Via e-mail only if the e-mail address is already registered in the Data Controller’s system, or
- A system designed to receive data subject requests (i.e. data access portal).
The data subject is free to choose whichever method he/she wants to use, and it is not possible to force the data subject to use a specific method.
Consequences of an Invalid Data Subject Request
If the data subject request is not in line with the requirements mentioned above, which are determined in the Communiqué, in general the data controller is not required to respond since the request would not be a valid request.
Having said that, the DPA’s decisions suggest that the best course of action would be to assist the data subject by:
- informing the data subject as to which information must be present in their request and what methods can be used for a valid request and
- refraining from creating additional/unnecessary burden on the data subjects by asking for additional information that is not present in the Communiqué.
This is, of course, a risk-based decision that must be taken by the data controller based on the circumstances.
Consequences of a Valid Data Subject Request
Data controllers have a general obligation to take all measures to finalize all data subject requests in good faith and in an effective manner pursuant to Art. 6 of the Communiqué.
In case of a valid data subject request, the data controller either accepts the request and takes necessary action, or if there are valid grounds, refuses the request and responds to the data subject.
The data controller must finalize the data subject request as soon as possible and within 30 days at the latest, without any charges. Having said that, if the response requires an expense (i.e. if the response is 10+ pages), the data subject may be charged.
Consequences of Not Responding to or Not Accepting a Valid Data Subject Request.
The DPL does not determine a specific consequence for not responding to or not accepting a valid data subject request. Having said that, in those cases, the DPA evaluates that the data controller has not taken all measures to finalize all data subject requests in good faith and in an effective manner.
As a result, in case of a complaint, the DPA’s initial decision is to instruct the data controller to take all measures to finalize all data subject requests in good faith and in an effective manner. If the data controller fails to implement and abide by the instruction of the DPA, the DPA may apply an administrative fine of up to TRY 5.971.989 (approx. USD 305.985 as of 09.05.2023) for failure to fulfill the decisions issued by the DPA.
Burak Ozdagistanli, CIPM, CIPPE, LL.M.