Assessment of the Council of State's Decision of 9 October 2018 Suspending the Execution of the Regulation on Personal Health Data

28 November 2018Murat Volkan DülgerCommentary

Introduction

This work was written in Turkish. The summary on this page is a translation; the citation gives the original title in parentheses.

The “Regulation on the Processing of Personal Health Data and Ensuring Their Privacy” has been the subject of debate many times and, so to speak, has never quite been put on a firm footing. The first version of the Regulation was criticised as a premature piece of regulation. It was published when Law No. 6698 on the Protection of Personal Data (KVKK) had only just been published, when some of the concepts and definitions in it had not yet been fully understood and, most importantly, when the Personal Data Protection Board, to which it frequently refers, had not yet taken office, and therefore without the Board’s views on the matter having been obtained. Indeed, the execution of the Regulation was suspended by the Council of State; some amendments were then made accordingly and the Regulation was published again in its amended form.

I think the amendments clearly showed the aim of trying to make rules that are compatible with and parallel to the personal data protection legislation. Nevertheless, I should state that even the amended version of the Regulation leaves a number of serious doubts as to whether the protection of personal data is ensured. Indeed, in my previous assessment of the subject I set out my criticisms of each individual amendment. Because the Regulation, even in its amended form, failed to bring satisfactory innovations for the protection of personal health data, it was challenged before the Council of State by the Turkish Medical Association and the Turkish Dental Association.