PROCEDURES AND PRINCIPLES TO BE APPLIED REGARDING THE OBLIGATION OF ENLIGHTENMENT IN PROCESSING THE PERSONAL DATA

A Communiqué on the procedures and principles to be complied with whilst fulfilling the obligation of enlightenment (in Turkish, “Aydınlatma Yükümlülüğü”) (“Communiqué”) has been published in the official gazette dated 10 March 2018 and has come into force on the same date.

As you well know, according to article 10 of the Code on the Protection of Personal Data (“CPPD”) and the Communiqué, the data controller or the person authorized by the data controller is obliged to inform the data subjects on the below issues at least:

1. The identity of the data controller and the data controller’s representative, if any,
2. The purposes of processing the personal data
3. The purposes of transferring the personal data and the parties to whom the personal data is transferred,
4. The methods and legal causes for collection of personal data (legal cause has been defined in (j) below),
5. The rights of data subject set forth under article 11 of the CPPD.

In this respect, as per the recently published Communiqué, the following principles and procedures shall be applied whilst fulfilling the obligation of enlightenment through physical or electronic means verbally or in writing :

1. The obligation of enlightenment shall be fulfilled in all cases where the personal data is processed in accordance with the explicit consent of the data subject or other processing conditions in CPPD;
2. When the purpose of data processing changes, the obligation of enlightenment shall be carried out for this new purpose as well before starting to process the data;
3. If personal data is processed for different purposes in different units /departments of the data controller, the obligation of enlightenment shall be fulfilled before each unit/department individually;
4. In the existence of the obligation of registration to the Data Controllers’ Registry, the information to be given to the data subject within the scope of the obligation of enlightenment must be in compliance with the information disclosed to the Registry;
5. The fulfillment of the obligation of enlightenment does not depend on the request of the data subject;
6. The burden of proof for fulfillment of the obligation of enlightenment belongs to the data controller;
7. If the personal data processing is carried out on an explicit consent basis, the obligation of enlightenment and the receipt of the explicit consent must be performed separately;
8. The purpose of processing personal data to be declared within the scope of the obligation of enlightenment must be certain, clear and legitimate. When the obligation of enlightenment is fulfilled, general, unspecific and uncertain expressions shall not be used. Also it should be refrained from using expressions that shapes an opinion that the personal data may be processed for further purposes that may be in question in the future;
9. The notifications to be made to the data subject shall be made by using a clear, comprehensible and simple language;
10. The “legal cause” mentioned in article 10 of CPPD means to clarify under the scope of the obligation of enlightenment which of the processing conditions mentioned in articles 5 and 6 of CPPD are applied. The legal cause must be clearly stated during the fulfillment of the obligation of enlightenment;
11. Under the obligation of enlightenment, the purpose of transferring personal data and the groups of recipients must be specified;
12. It shall be clearly stated whether the personal data is obtained, wholly or partly through automatic means or through non-automatic means forming a part of data recording system;
13. Whilst performing the obligation of enlightenment, misleading and incorrect information shall not be provided to the data subjects.

If the relevant personal data is not obtained directly from the data subject, the obligation of enlightenment shall be fulfilled within a reasonable period of time and in any case if the personal data will be used to contact the data subject, at the date of first contact and if the personal data will be transferred, latest at the date of transfer.

Our Law Firm remains at your disposal for any further clarifications you may need.