On 16 December 2020, Turkey’s Personal Data Protection Authority (the “Authority”) announced (the “Announcement”) on its website regulations applicable to public disclosure of personal data by data processors.
The Announcement provides, in relevant part, as follows:
Articles 5 and 6 of the Personal Data Protection Law number 6698 (the “Law“) regulate the handling of personal data by data processors (as that term is defined by applicable law). Article 5 in particular provides, inter alia, that public disclosure of an individual’s personal data may be accomplished lawfully only by that same individual.
Article 5 incorporates the notion of intention; so that public disclosure by a data processor of an individual’s personal data, whether accidentally, inadvertently, or otherwise, absent the intention of that individual to make the data public is unlawful under Article 5.
In determining the legality of a data processor’s public disclosure of an individual’s personal data, the Law also considers the purpose of such disclosure; and, if it was not directly related to, or in direct furtherance of the specific purpose for which the data was initially provided, then the disclosure is unlawful.
In a recent matter the Authority ruled that an individual’s personal data uploaded to a vehicle sales website may be disclosed publicly on that website only for the purpose of facilitating the sale of the listed vehicle. Publication for any other reason is unlawful under the Law.
Notably, Article 5 (d)(2) does not apply instances where personal data, including, name, surname, phone number, email address, etc., is obtained by a data processor from an ostensibly public source – e.g., an individual’s public social media account – and used for targeted advertising, via SMS or email.
The Authority proposed the following analysis for determining whether a data processor’s public disclosure of an individual’s personal data was lawful under Article 5(b)(2) of the Law; to wit: (i) whether the publication was in accordance with the individual’s will or intent, (ii) the data process’s purpose in publishing the data, (iii) whether the publication was in compliance with the General Principles of Article 4 of the Law.
Please see this link for the full text of the Announcement (only available in Turkish).
