The Personal Data Protection Board (“Board”) issued a decision, dated 27 January 2020, and numbered 2020/50, regarding a data controller’s processing of personal data from a business email account without express consent.
In the instant case, certain personal data of petitioner-data-subject (“Petitioner”) contained in Petitioner’s business email account were processed by a data controller without Petitioner’s express consent. Petitioner was a partner in the business that maintained the email account.
As a response to Petitioner’s complaint, the data controller claimed processed Petitioner’s personal data in furtherance of a criminal case against petitioner being prosecuted in trail court at the time of processing; and transmitted data only to the trial court and the public prosecutor’s office.
The Board ruled in favor of the data controller, finding that, notwithstanding the express consent – of either Petitioner, the business, or both – requirement, the processing was lawful under Article 28 of the Personal Data Protection Law numbered 6698 because it was in furtherance of prosecution of a pending criminal suit against Petitioner.
A summary of the decision discussed is available at the following link. (Only available in Turkish)
