Assessment of the Decision Summaries Published by the Personal Data Protection Board on 20 April 2018

30 April 2018Murat Volkan DülgerCommentary

Introduction

This work was written in Turkish. The summary on this page is a translation; the citation gives the original title in parentheses.

One of the matters that aroused most curiosity in the field of personal data protection was undoubtedly the decisions that the Personal Data Protection Board would render. Because the practice was new, many open questions naturally caused confusion: which points the Board would attend to and give weight to when deciding, which subjects the decisions would concentrate on, on what basis a breach would be assessed in a specific case, and whether the decisions would be published. At last a development capable of answering such questions to a certain extent has taken place, and the Board has published summaries of some of the decisions it has rendered.

The publication of a variety of decisions finding breaches in relation to personal data offers guidance, particularly for those concerned with the subject and for data controllers and data processors who have to bring themselves into compliance with the obligations introduced by Law No. 6698 on the Protection of Personal Data (KVKK). I will examine the decisions published by the Board from the standpoint of the obligation that was introduced by the KVKK and is the subject of each decision, and I will touch on the points at which, and the reasons for which, a breach was found in the specific case. In this way I will try to make the Board’s approach to the subject understood and to enable the KVKK to be considered and assessed within the scope of the decisions rendered.