Information Note of the Turkish Personal Data Protection Authority on the Personal Data Processing Conditions Provided for by the Laws

Hande Çağla Yılmaz co-authored this article.

The Turkish Personal Data Protection Authority ("Authority") published "Information Note on the Personal Data Processing Conditions Provided for by the Laws” on the "expressly provided for by the laws" personal data processing condition regulated under the Article 5/2-a of the Turkish Personal Data Protection Law ("PDPL") on the official website of the Authority on 12/02/2024.

In the first part, the Authority stated that if there is a provision for the processing of personal data in the law or secondary regulations, Article 5/2-a of the PDPL will be relied upon. For example, the preparation of a personnel file by the employer (processing of the employee's identity data) in accordance with Article 75 of the Turkish Labor Law No. 4857 may be considered within this scope. Also, the Authority stated that no literal interpretation should be made regarding the term "expressly” stated under the Article 5/2-a of the PDPL, otherwise the processing condition would have a very limited application area. In this context, payment of wages in accordance with the Article 8 of the Turkish Labor Law No. 4857 (processing of the employee's bank account number, marital status, dependents, whether his/her spouse is working, social security number information, etc.) is given as an example.

In the second part, the Authority stated that the personal data processing conditions of “necessary for compliance with a legal obligation to which the data controller is subject” in the Article 5/2-ç of the PDPL and “expressly provided for by the laws” in the Article 5/2-a PDPL are regulated together in the Article 6/1-c of the EU General Data Protection Regulation (“GDPR”). Regarding the evaluation of whether the data processing activity is a legal obligation of the data controller, the Authority, by giving an example from the Guide[1] prepared by the Irish Data Protection Authority; stated that, in line with the principles of transparency and accountability, the data controller should evaluate whether the processing is “necessary” to comply with the obligation in question. In addition, the personal data processing requirement under GDPR 6/1-c may be based on law or also on secondary regulation was emphasized.

You can find the Information Note here (in Turkish).

[1] Guidance Note on Legal Basis for Processing Personal Data