Turkey’s Constitutional Court recently dismissed an application seeking to suspend and strike out certain clauses in the Data Protection Law number 6698 (“Law”). 124 deputies applied on the basis that the clauses are vague, broad, subjective, open to interpretation and are not proportional. The court considered international legislation, EU legislation and Turkey’s Constitution, ultimately deciding that the clauses were not unconstitutional.

The applicants claimed the following clauses in the Law explicitly contradict the Constitution and could cause irreversible consequences to the state of law:

  • Article 4/2(d) states the principle for processing personal data as “Being stored only for the time designated by relevant legislation or necessitated by the purpose for which data are collected”. The applicants objected to the underlined phrase.
  • Articles 5/2(c), 5/2(ç), 5/2(e) and 5/2)(f), which are exceptions that allow personal data to be processed without explicit consent from the data subject.
  • “sect” and “appearance and clothing” as special categories of personal data under Article 6/1.
  • Article 6/3, which states that other than personal data relating to health and sexual life, special categories of personal data can be processed without obtaining the explicit consent of the data subject, if processing is permitted by law.
  • The text in Article 8/3 and Article 9/6 which reserve provisions for transferring personal data to third parties and abroad in other laws.
  • The exclusion in Article 15 in the context of the documents to be presented to the Board during an investigation, which allows information and documents concerning state secrets to be omitted.
  • The text in Article 16/2 which authorizes the Data Protection Board (“Board”) to develop exemptions to the requirement to register with the Data Controllers Registry, based on certain criteria.
  • Article 24/3(b) states the Board may publish its decision if deemed necessary. The applicants objected to the underlined phrase.
  • Article 28/ç, which states that data processing activities of the public authorities authorized by the relevant laws, for the purposes of national defense, national security, public security, public order and economic safety shall be exempt from the Law.

The full text of the Constitutional Court’s reasoned decision was published in Official Gazette number 30310 on dated 23 January 2018 and can be found at this link (only available in Turkish).