Assessment of the Personal Data Protection Board's Latest Announcement on the COVID-19 Pandemic

Murat Volkan Dülger^*

On 27 March 2020 the Personal Data Protection Board published a public announcement on what needs to be known about the processes of processing personal data in the context of the fight against the COVID-19 virus.

As the Board also states, in the extraordinary pandemic situation in which we find ourselves, the processing of individuals’ data (Turkish identity number, address, workplace, travel information) and of data of special categories, which are regarded as categorically more sensitive than the others, is unavoidable. One of these is data relating to “the health of individuals”¹. These data benefit from the protection of the Law on the Protection of Personal Data (KVKK) to a greater extent than other data.

Although I agree with the Board that the requirement that personal data be processed lawfully and on the basis of the fundamental principles also applies in the exceptional situation of a pandemic, and that irreversible harm to fundamental rights and freedoms must be prevented, I must note that these statements have come rather late.

Indeed, the United Kingdom’s data protection authority (ICO), before going into detailed explanations, published a note briefly recalling the fundamental principles in the days when the outbreak began to spread². After examining the Board’s announcement in detail, I too gained the impression that the delay stemmed from waiting for the ICO’s detailed statement. The ICO, which had published an announcement containing recommendations and opinions two days earlier, had addressed the same headings and questions³.

Below I shall touch on a number of questions answered by the Board that caught my attention:

• May an employer disclose to an employee’s colleagues/its other employees

that the employee is carrying the virus?

The Board says that the employer should inform staff about cases. It also adds that, when this information is given, it will not be necessary to give the names of individuals and that no more information than necessary should be given; and that, in cases where disclosing the name of the employee(s) infected with the virus is essential for the taking of protective measures, it would be more helpful for the employees concerned to be informed of this in advance. The employer has the responsibilities of ensuring the health and safety of its employees and, at the same time, of fulfilling its duty of care.

The Board illustrated this as follows: “In this context, employers may in the first instance make statements such as, for example, ‘…We wish to inform you that the COVID-19 test of a colleague working on the 5th floor of our Head Office building has returned positive. Taking into account the dates on which our colleague who tested positive was in the building, we shall identify the persons who have been in contact with our colleague and inform them of the situation…’.”

First of all, the question whether the employer may know this at all ought to have been assessed from the standpoint of the Law. After all, employers in the private sector, too, always remain bound by the general principles in Art. 4 KVKK and act in accordance with Arts. 5 and 6, which contain the conditions for processing.

Article 6 sets out the conditions for processing special categories of personal data and presents “explicit consent” as the main rule. On this matter, paragraph 3 of the article states: “…personal data relating to health and sexual life, however, may be processed without seeking the explicit consent of the data subject only for the purposes of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing, by persons under a duty of confidentiality or by authorised institutions and organisations.”

As we understand from this, the employer is not, under this article, in a position to be authorised to process special-category information without explicit consent. Although it is clear that under the Law the employer may not know this, an announcement which, without assessing that point, assumes that the employer knows and concerns itself with the proposition that the employer should not tell the other employees appears to be mistaken. We may, however, assume that what is meant by the employer here is – where there is one – workplaces that are obliged to have a workplace physician. In that case we need to look at the obligations of workplace physicians⁴.

According to Art. 9(2)-8 of this regulation, “To provide the necessary hygiene training, in addition to work on preventing spread and on immunisation for the control of communicable diseases, and to ensure that the necessary examinations and tests are carried out” is listed among the duties of workplace physicians. Of course, the workplace physician’s duty of confidentiality prevents the patient’s information from being shared, but the physician can determine the risk situation by putting different questions to the persons around the sick person. Moreover, if the sharing of a name is necessary, that is, if the result cannot be achieved without a name being shared, we can overcome this problem within the framework of the principle of proportionality. After all, the workplace physician must at the same time protect the health of the other employees as well. In this sense there may be some flexibility in the concept of secrecy. However, this problem still persists for workplaces which do not have a workplace physician although they are required to have one, or which are not required under the legislation to have a workplace physician. In this latter case, how the employer is to process an item of personal health data which it should not in fact possess still remains a question mark.

In addition, the authorised institutions and organisations that may process personal data relating to health for the stated purposes and under a duty of confidentiality are determined by the Ministry of Health in accordance with the relevant legislation and the Health Services Law⁵. The processing of data concerning persons who have fallen ill because of the coronavirus is no exception and is subject to equally strict conditions. The data in question must be “processed for a specific purpose”. Processing for the protection of public health is one of these purposes, and it will bring into play not only the treatment and cure of an individual medical case or illness but also processing for the purposes of developing organisational models and education policies, planning preventive health services, and preventing the emergence or recurrence of societal medical problems in a situation such as an epidemic⁶.

Although it may be said that those who are currently carrying out statistical and similar studies for these purposes in the context of the coronavirus pandemic also have specific processing purposes and may be regarded as being among those listed, all power and duty in the matter of the protection of public health belongs to the Ministry of Health⁷.

In conclusion, as the announcement also notes, as provided in Article 28, paragraph 1,

sub-paragraph (ç) of the Law, since the present situation threatens public security and public order, there is no obstacle to the processing of personal data by the Ministry of Health and by the public institutions and organisations falling within the scope of this article.

• Notification of Illness by the Employee of His or Her Own Free Will

Another point in the Board’s announcement that caught our attention is the following: “Within this framework, particularly as regards the processing of health data, obtaining the employee’s consent may be preferred; and, considering the speed at which the outbreak is spreading, the employee may also give notification of illness of his or her own free will. Under the conditions other than explicit consent, on the other hand, health data will be processed by workplace physicians.”

As I explained above, it is clear that the employer may not know this; yet, in addition to an announcement about the employer nonetheless not disclosing it, this statement addressed to individuals, along the lines of “let everyone shoulder the responsibility themselves”, appears rather curious. The announcement then goes on to state that the data may be processed by workplace physicians; in short, practice will continue in the same way without any change.

However, the following point has been forgotten: because of the pandemic, almost all physicians are occupied with this outbreak, and it is impossible to have a physician present at every moment in every place where temperatures are taken. Yet when you enter a workplace, a supermarket, a courthouse or a hospital, your temperature is taken by an attendant and, if your temperature is high, action is taken. This, too, is a case of personal data processing. Bearing in mind that it is also impossible to find a physician in this situation, how are controllers expected to act? At a time when everyone is struggling to stay alive, how realistic is it to make a statement that amounts to telling people that they may not process personal health data, and to leave this to individuals’ own initiative? Can it be said in this situation that the administrative authority has fully and properly discharged the responsibility it has assumed?

As a result of this statement, the question marks in the minds of controllers, of those who advise on this subject and of the academics who work on it have not disappeared. Yet the expectation is that the Board will take the initiative as soon as possible and take concrete and realistic steps in this matter.

In these difficult days, too, the law must of course be applied without exception. Under no circumstances should special categories of personal data be processed without a ground of justification. However, the essential right that is sought to be protected in this extraordinary period is the right to life, and it ranks above the right to the protection of personal data. Is it therefore not possible here, as in criminal law, to accept the “theory of social adequacy” as a condition for data processing, for the duration of the extraordinary period and limited to the requirements of that period?

In fact, in this situation the Board’s hands are tied as well. Faced with the existing provision (Art. 6 of KVKK No. 6698), the Board too is trying to be as explanatory as it can. The real problem here lies in Article 6 itself. This article, which I have criticised many times before and from different angles, has once again – and in so important and urgent a situation – shown how deficient it is. Accordingly, it is parliament that must really take the initiative here. Without losing any time, a government bill or a private member’s bill should be submitted to the Grand National Assembly of Türkiye (TBMM), and an article of an exceptional nature should be added to the Law setting out how, by whom, for how long and for what purpose personal health data may be processed in such extraordinary periods, and with whom they may be shared.

• Travel Information

In the announcement we find the answer to an important question: it has been clarified that travel data are not health data. We had doubts as to whether such data could be regarded as derived data by virtue of the person being treated as a suspected coronavirus case. However, by saying in its statement that “In this process, naturally, not every item of data processed will be special-category personal data (for example, information on the country to which persons last travelled). In these cases, too, the conditions for processing personal data in Article 5 of the Law will have to be taken into account.”, the Board has indicated that this information falls within the scope of Article 5.

I, too, am of the view that travel information may be collected. In fact, the purpose of collecting this information is to learn not where people have travelled but the likelihood of the disease having been transmitted. We generally assess personal data according to the purposes for which they are processed. For example, we do not regard biometric photographs as biometric data if the controller has no such purpose. Here, however, the situation is exactly the reverse. These data are not in fact personal health data, but the controller is indirectly trying to obtain health data. Although I consider this practice appropriate in the circumstances in which we find ourselves, I must note that it is not very appropriate from the standpoint of the general principles governing personal data and the conditions for data processing, and that it creates a grey area.

Conclusion

As I also noted above, the Board’s announcement coincides almost exactly with the ICO’s announcement. It has disappointed us that the statement, which came late enough as it was – perhaps after many breaches had already been caused – has the character of a borrowing rather than focusing on the problems in its own national practice.

Although the problem of data protection is an international matter, every country must prepare its rules, especially in such an exceptional situation, with its own practice and its own legal institutions in mind.

Furthermore, as I stated above, remedies specific to this period must be devised, taking into account the conditions of this extraordinary period, and people must be freed as soon as possible from the dilemma of whether to grapple with survival or with the law. This is the responsibility of the competent authority. The competent authority here, however, is not the Board; it is the TBMM and the political parties that must set the TBMM in motion. Unless Article 6 of the KVKK is amended in line with what can be foreseen for situations of this kind, it is not possible to give complete, concrete, workable and realistic answers to these questions.