The Board of Protection of Personal Data Has Published New Decision Summaries 28 February 2019

You can find the most recent three decision summaries as following:

1. Sharing of Personal Data of Special Nature with A Third Party by the Data Controller Without Subjecting to Any Processing Condition

In the application for complaint subject to the Board’s Decision dated 05.12.2018 and numbered 2018/143 as a summary; health data of a natural person who uses medication under the control of a doctor has been shared with a third party by the pharmacy he/she procures his/her medicines from without subjecting to any condition where it is possible to process the personal data of special nature without explicit consent regulated in the Article 6 Sub-Article (3) of the Law numbered 6698.

As a result of its examination, the Board decided to impose administrative fine pursuant to the Article 18 of the Law on the Data Controller Pharmacy which violates the obligation of not to make the personal data public and not to use personal data outside of its processing purpose contrary to the provisions of Law and which shared the personal data of special nature of a natural person with a third party without subjecting to any condition regulated in the Article 8 Sub-Article 2 of the Law where it is possible to transmits the personal data without explicit consent of the related person. 

2. A Natural person’s Personal Data which has been shared via the Web Site of A Company in order to shop Becoming Accessible to the Third Parties and the Request for Deletion of These Data

In the application for complaint subject to the Board’s Decision dated 26.07.2018 and numbered 2018/91 as a summary; the complainant’s a number of personal data such as his/her membership information, delivery address, name, surname, phone number shared to do shopping from a ready-made clothing company from its web site have become accessible to third parties and due to this reason, the complainant has requested from the firm his/her personal data to be deleted, annihilated, rendered unachievable, also deleted and annihilated before the other institutions where personal data have been shared with at home and abroad.

The defense and justifications of the Data Controller concerning the personal data became accessible to third parties such as they were not aware of the situation until the incident and the incident has arisen from a systematic error are found insufficient by the Board and as a consequence, the Board has decided to impose administrative fine pursuant to the Article 18 of the Law on the Data Controller Company which did not fulfill his/her obligation to take any kind of necessary technical and administrative measures towards providing the proper safety level in order to provide the conservation of personal data and prevent unlawful access to personal data.

In terms of the request for annihilation of the personal data which has become accessible to third parties; due to the fact that the Board has detected that the reasons for processing of the data disappeared in the present case and that the complainant have the right to demand the annihilation of his/her personal data in this context according to the Article 11 of the Law; the Board decided to accept the complainant’s requests and they decided that the company shall announce the transactions to be made in this matter and transmit to the complainant within 30 days from the notification of the decision together with the supporting documents.

3. Request for Annihilation of Documents in regard to the Investigation-Prosecution Files of Public Officers During Their Incumbency

In the application for complaintsubject to the decision of the Board dated 28.06.2018 and numbered 2018/69 concerning the request for annihilation of documents in regard to the investigation-prosecution files opened about public officers during their incumbency, as a summary; the Board has decided that it is appropriate to refuse the requests of the public officers by reason of the fact that the documents requested to be annulated are partake of the documents required to be preserved in the personal file pursuant to the Article 109 which titled “Public Officer Information System, Personal File” of the Law numbered 657.

According to the Article 7 Sub-Article 1 of the Law numbered 6698; in case the reasons that require processing are disappeared, the related person may request the deletion, annulation or anonymization of his/her personal data.

However said documents are kind of documents that have to be preserved in the personal files of the public officers as it is regulated in the Law numbered 657 and the personal files of the officers whose duties have been terminated for any reason should be preserved according to the Public Servant General Communique (Serial No: 2). Furthermore, said personal files shall be found in the context of the officialdom registration files until one hundred one years passed over the last transaction date. Under the circumstances, processing reason has not disappeared yet pursuant to the Article 7 of the Law numbered 6698 and the refusal of the request by the said public institutions has been found appropriate by the Board