LAW ON THE PROTECTION OF PERSONAL DATA

Law No.: 6698
Date of Adoption: 24 March 2016
Published in the Official Gazette: 7 April 2016 – No. 29677

CHAPTER ONE

Purpose, Scope and Definitions

Purpose

ARTICLE 1 –
(1) The purpose of this Law is to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, with regard to the processing of personal data, and to regulate the obligations, procedures and principles to be followed by natural and legal persons processing personal data.

Scope

ARTICLE 2 –
(1) The provisions of this Law shall apply to natural persons whose personal data are processed and to natural or legal persons who process such data wholly or partly by automated means, or by non-automated means provided that the processing forms part of a data filing system.

Definitions

ARTICLE 3 –
(1) For the purposes of this Law:

a) Explicit consent: Consent relating to a specific matter, based on being informed and expressed freely,

b) Anonymization: Rendering personal data impossible to associate with an identified or identifiable natural person under any circumstances, even by matching such data with other data,

c) President: The President of the Personal Data Protection Authority,

ç) Data subject: The natural person whose personal data are processed,

d) Personal data: Any information relating to an identified or identifiable natural person,

e) Processing of personal data: Any operation performed on personal data, whether wholly or partly by automated means or by non-automated means provided that the processing forms part of a data filing system, including collection, recording, storage, retention, alteration, rearrangement, disclosure, transfer, acquisition, making available, classification or prevention of use,

f) Board: The Personal Data Protection Board,

g) Authority: The Personal Data Protection Authority,

ğ) Data processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller,

h) Data filing system: A filing system in which personal data are structured according to specific criteria,

ı) Data controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.

CHAPTER TWO

Processing of Personal Data

General Principles

ARTICLE 4 –

(1) Personal data may only be processed in accordance with the procedures and principles set forth in this Law and other applicable laws.

(2) The following principles shall be complied with when processing personal data:

a) Processing lawfully and fairly,

b) Ensuring that data are accurate and, where necessary, kept up to date,

c) Processing for specified, explicit and legitimate purposes,

ç) Processing in a manner that is relevant, limited and proportionate to the purposes for which the data are processed,

d) Retaining data only for the period prescribed by applicable legislation or necessary for the purposes for which the data are processed.

Conditions for Processing Personal Data

ARTICLE 5 –

(1) Personal data shall not be processed without the explicit consent of the data subject.

(2) Personal data may be processed without obtaining the explicit consent of the data subject where one of the following conditions applies:

a) It is expressly provided for by law,

b) It is necessary for the protection of the life or physical integrity of the person or another person who is unable to express consent due to actual impossibility or whose consent is not legally valid,

c) Processing is necessary for the conclusion or performance of a contract, provided that it is directly related to the personal data of the parties to the contract,

ç) Processing is necessary for the data controller to fulfil its legal obligations,

d) The personal data have been made public by the data subject,

e) Processing is necessary for the establishment, exercise or protection of a right,

f) Processing is necessary for the legitimate interests of the data controller, provided that such processing does not violate the fundamental rights and freedoms of the data subject.

Processing of Special Categories of Personal Data

ARTICLE 6 –

(1) Personal data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are considered special categories of personal data.

(2) Processing special categories of personal data without the explicit consent of the data subject is prohibited.

Erasure, Destruction or Anonymization of Personal Data

ARTICLE 7 –

(1) Even where personal data have been processed in accordance with this Law and other applicable laws, such data shall be erased, destroyed or anonymized by the data controller ex officio or upon the request of the data subject when the reasons requiring their processing cease to exist.

Transfer of Personal Data

ARTICLE 8 –

(1) Personal data shall not be transferred without the explicit consent of the data subject.

(2) Personal data may be transferred without explicit consent where the conditions stipulated under the applicable provisions of this Law are satisfied.

Transfer of Personal Data Abroad

ARTICLE 9 –

Personal data may be transferred abroad only in accordance with the conditions and safeguards prescribed under this Law and the applicable regulations.

CHAPTER THREE

Rights and Obligations

Data Controller's Obligation to Inform

ARTICLE 10 –

At the time personal data are collected, the data controller or its authorized representative shall inform the data subject about:

a) The identity of the data controller and, where applicable, its representative,

b) The purposes for which personal