Assessment of the Personal Data Protection Board's Public Announcements on the “Time Limit for Complaints to the Board” and “Data Breach Notification”

18 February 2019Murat Volkan DülgerCommentary

Introduction

This work was written in Turkish. The summary on this page is a translation; the citation gives the original title in parentheses.

At a time when new developments occur every day in the field of personal data protection, an important step has most recently been taken, again by the Board, in the form of a series of public announcements. I should point out that the formation of a branch of law is a matter that goes well beyond enacting legislation specific to the subject and developing a theory. For a branch of law to form, the enactment of norms of positive law is a necessary element, but it is not sufficient on its own. What is needed, rather, is for concrete cases on the subject to arise, for the legal norms that have been enacted to be applied to those cases and for decisions to be given on them. Accordingly, alongside the legislation on the subject, there must be a field in which that legislation is applied.

In this way the concept of case law, which is an indispensable and at the same time complementary element of law, will emerge. For only then can a branch of law be said to have formed. The field of personal data protection is at exactly this point. Since the publication of Law No. 6698 on the Protection of Personal Data (KVKK), the steps taken, particularly as regards statutory rules, have produced an extensive body of legislation. The decisions given by the Board on the complaints made to it and in the context of concrete cases are allowing practice and case law specific to the subject to develop. The publication of the applications, complaints and breach notifications made under the KVKK is also important, because it brings concrete examples to light.