Protection of Voter's Personal Data in the Election Process

1.     Entrance

Elections are undoubtedly one of the most important and topical issues on the agenda of our country. The conduct of electoral activities within the framework of the constitutional right to vote and to be elected, in particular propaganda, is indispensable for the exercise of this right and is a prerequisite for a democratic society. During the 31 March local elections, as in other election processes, many personal data such as names, telephone numbers, e-mail addresses of many voters are processed by research companies, YSK, political parties and candidates. Undoubtedly, the activities for processing this data must be in accordance with the law. However, thanks to the developing technology, the above mentioned data processors and data controllers have reached many voters and many personal data breaches have occurred during the election process. This article examines the data controllers and data processors who process the data of voters, the personal data of voters processed and the conditions under which personal data may be processed, the obligations of the data controllers, the rights of the data subject and the remedies available in the event of personal data breaches.

2.     Data Controllers and Data Processors

Article 3 of the Personal Data Protection Act No. 6698 defines the data controller as "the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system". Under this article, research companies, YSK, political parties and independent candidates are recognised as data controllers during the election.

A) YSK

According to Article 79 of the Constitution, the direction and supervision of the elections are carried out by the judicial organs, and this duty has been given to the Supreme Election Board by the Law No. 7062 on the Organization and Duties of the Supreme Election Board. Within the framework of the YSK Constitution and election legislation; processes personal data for business and transactions such as creating, arranging, updating, suspending voter registers, giving them to the relevant parties (through the system or in print), giving information, documents and lists related to the election to the relevant persons, etc., and can transfer these data within the framework of the relevant provisions, and the YSK is the data controller in the context of these activities.[1] In Article 6 of the Law No. 7062 on the Organization and Duties of the Supreme Election Board, the duties of the Supreme Election Board (YSK) are specified. Among these duties, the duties of the YSK that may be related to the processing of voters' personal data are as follows[2]:

- To carry out or cause to be carried out, from the beginning to the end of the election, all procedures relating to the proper conduct and integrity of the election, To determine the procedures and principles regarding the creation, updating, management and supervision of the voter register,

- To inform citizens about the importance and methods of organizing the voter register, as well as the duties and responsibilities of voters, through promotional programs.

B) Political Parties and Independent Candidates

Political parties process personal data within the scope of transactions such as establishment, membership, candidate determination activities in elections, election of authorized bodies and their notification to the relevant authorities in accordance with the relevant laws, especially the Political Parties Law No. 2820, and they can transfer this data within the framework of the relevant provisions. Political parties are accepted as data controllers within the scope of the Law on the Protection of Personal Data No. 6698. Independent candidates may also be considered as data controllers within the scope of the Law if they engage in "personal data processing" activities defined in Article 3 of the Law on personal data during the election processes.[3]

3.     Voter's Processed Personal Data and Data Processing Conditions

According to Article 3 of the Law on the Protection of Personal Data No. 6698, the processing of personal data  is defined as "Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic or non-automatic means, provided that it is a part of any data recording system means all kinds of operations performed on it".

In order for personal data to be processed in accordance with the law, first of all, 4. It must be processed in accordance with the general principles in the article[4]. These principles are; to be in compliance with the law and the rules of honesty, to be accurate and up-to-date when necessary, to be processed for specific, clear and legitimate purposes, to be connected, limited and measured for the purpose for which they are processed, and to be kept for the period stipulated in the relevant legislation or required for the purpose for which they are processed. As a reflection of these principles, data controllers should only process as much as necessary, data should not be processed to the detriment of the person, data processing should not be abused, and the reasonable expectations of the persons whose personal data are processed should not be exceeded.[5]

In addition to the general principles of the DPA, it is necessary to comply with the processing conditions of Article 5 of the DPA in order to process the data in accordance with the law. According to this article, in general, personal data cannot be processed without the explicit consent of the data subject. However, it has been established that in the cases listed in paragraph 2 of the article, the personal data of the data subject may be processed without obtaining his or her explicit consent. The most important of these exceptions for our subject is the case of "clearly established by law" in letter a).

On the other hand, it can be seen that the specific quality data of voters are also processed during the electoral process. In this case, the data must be processed in accordance with the processing conditions of Article 6 of the KVVK. According to the aforementioned article, sensitive personal data includes data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. As a general rule, it is prohibited to process sensitive data without the explicit consent of the data subject. 3 of the relevant article. This paragraph lists the exceptional cases in which the explicit consent of the data subject is not required for the processing of sensitive personal data, and among these cases, "the cases provided for by law" are important for our subject.  In the processing of sensitive personal data, it is also accepted as a condition to take the measures determined by the Personal Data Protection Board.

In some cases, it is also observed that personal data is transferred during the electoral process. If personal data is transferred, it must be done in accordance with Article 8 of the KVKK.

A.   Processing Conditions Regarding Personal Data Processed/Transferred by YSK and Relevant Public Institutions

Some of the voter's personal data is processed by the Supreme Electoral Board and transmitted to various public institutions and organisations. Some of these personal data may be processed without the voter's consent. The legal basis for the YSK's processing of personal data without the voter's consent is Article 5 of the Personal Data Protection Act. It is the state of "clearly established by law" in paragraph a) of the article. Examples of such situations arePersonal data that must be included in the voter register pursuant to Article 34 of Law No. 298 (name and surname data of the voter, name and surname of the voter's parents, year of birth of the voter, place of birth of the voter, district data of the voter),

·      Updating the voter register based on the address information of the voter in accordance with Articles 33, 35, 36 and 37 of Law No. 298,

·      Pursuant to Articles 39 and 40 of Law No. 298, the suspension of the voter registers in the headmen's offices,

·      Pursuant to Article 45 of Law No. 298, copies of the personal data of the voters written in the voter register are sent to the provincial and district election boards in the form of lists,

·      Distribution of voter information sheets pursuant to Article 44 of Law No. 298,

·      Pursuant to Article 68 of Law No. 298, the list of voters sealed by the district election board is sent to the presiding officers of the district election boards to be transferred to the heads of the polling stations,

·      Keeping election documents in accordance with Article 40 of Law No. 2839,

·      Submission of the voter register to the relevant persons in accordance with Article 47 of Law No. 298,

·      Pursuant to Article 94/D of Law No. 298, establishing a technical infrastructure and taking various security measures in order to enable voters abroad to vote electronically,

can be given.In some cases, based on the [6] authority granted to it by the election legislation and other relevant legislation, the YSK may process some sensitive personal data without the explicit consent of the voter in accordance with paragraph 3 of Article 6 of the KVKK. The personal data of a special nature processed by the YSK is subject to Article 8 of the KVKK, Article 3. In accordance with the paragraph, it can be transferred to the relevant institutions and organizations. Facilitating the voting of disabled voters pursuant to Article 6 of Law No. 7062, recording a disability that prevents voting in accordance with Article 36 of Law No. 298, and obtaining a list of visually and orthopedically disabled people and entering them in the voter register pursuant to Article 74 of Law No. 298 can be given as examples of this situation.

B.    Conditions of Processing of Voter's Personal Data by Political Parties and Independent Candidates

Political parties may also process the personal data of voters and transmit it to various institutions and organisations without the consent of the voters. In these cases, the fact that it is "clearly stipulated in the laws" in Article 5/2 of the CPC and Article 8/3 of the CPC appears as a reason for compliance with the law. Examples of such situations arePursuant to subparagraph d) of Article 10 of the Law No. 2820, the lists containing the personal data of the members registered in the party are recorded in the political party registry,

·      Processing and transferring the personal data of party members due to the holding of elections in accordance with Article 21 of Law No. 2820,

·      Pursuant to Article 42 of Law No. 2820, processing the personal data of the members to be recorded in the party voter lists,

·      Pursuant to Article 47 of Law No. 2820, the obligation to show a party voter card in order to vote in primary elections,

·      Keeping pre-election documents in accordance with Article 49 of Law No. 2820,

·      Keeping member registration books in accordance with Article 60 of Law No. 2820,

·      Pursuant to Additional Article 7 of the Law No. 2820, the possibility of keeping books, registries and records electronically,

·      Pursuant to Article 23 of Law No. 298, determining the members of the polling station to take part in the elections and processing the personal data of the members of the polling stations,

·      Preparation of polling station suspension lists in accordance with Article 39 of Law No. 298,

·      Pursuant to Article 47 of Law No. 298, keeping the voter register and giving it to the relevant persons,

·      Pursuant to Articles 55/B of Law No. 298 and Article 5 of Law No. 6698, processing personal data for the purpose of making verbal, written or visual propaganda to the members of political parties through advertisements and advertisements in the print media or by opening a website,

states can be shown.[7] During the election process, it is observed that political parties and independent candidates often send audio, video or written messages to voters for propaganda purposes. As mentioned above, political parties can only make propaganda to their members through verbal, written or video messages. Political parties' sending propaganda messages to non-members without consent, processing and storing their data results in a violation of personal data. When the issue is considered in terms of independent candidates; According to the personal data protection legislation, Law No. 298 and various decisions taken by the YSK, it can be said that independent candidates cannot be data controllers and cannot make propaganda to the voters through verbal, written or video messages for propaganda purposes.[8]

4.     Obligations of Data Controllers

A)   Lighting

As a rule, the obligation to provide information is fulfilled in accordance with Article 10 of the Code. According to this article, when collecting personal data, the controller is obliged to inform the data subjects of their identity, the purpose of the processing, the subjects and purposes to whom the data will be communicated, the method of data collection and the legal grounds, as well as of their other rights. In fulfilling the information obligation, the Communiqué on the procedures and principles to be followed in fulfilling the information obligation must be respected. Political parties and independent candidates must comply with the principles set out in Article 10 of the KVKK when fulfilling the duty to inform. On the other hand, there is an exceptional situation for the YSK. The YSK, which has the authority to organise and supervise elections, is not subject to the obligation to provide information under Article 28(c) of the KVKK.

B)   Registration in the Data Controllers Registry (VERBIS)

According to Article 16 of the KVKK, those who process voters' personal data must register with VERBIS before they start processing the data. On the other hand, the YSK is not obliged to register with VERBIS under Article 28/2 of the KVKK, as is the case with the obligation to provide information. On the other hand, political parties have been exempted from the obligation to register with VERBIS in accordance with the decision of the Personal Data Protection Board dated 02.04.2018 and numbered 2018/32. Therefore, political parties are not obliged to register in VERBIS.

C)   Data Security

According to Article 12(1) of the Act, data controllers are obliged to take technical and administrative measures to prevent unlawful processing of personal data and unlawful access to personal data, and to ensure an appropriate level of security to ensure the protection of personal data. For this reason, all data controllers who process personal data during election processes are required to act in accordance with their data security obligations under Article 12 of the Act.

D)   Deletion, Destruction, and Anonymization

Pursuant to Article 7 of the DPA, personal data shall be erased, destroyed or made anonymous by the data controller ex officio or at the request of the data subject when the reasons for processing no longer apply. This process is governed by the Regulation on the deletion, destruction or anonymisation of personal data. When the reasons for processing personal data in the electoral process cease to exist, the personal data must be destroyed by the relevant data controllers using appropriate methods. In addition, if there are legal periods for the storage of data, these periods should be taken as a basis; if no such period has been determined, the data should be destroyed at the end of the storage periods to be determined ex officio by the data controllers, taking into account the purpose of the processing of personal data.

5.     Rights of the Voter Whose Data Is Processed

The Law on the Protection of Personal Data No. 6998 has introduced some methods of seeking rights to the person concerned, as well as directly applying to the judiciary in case of violation of personal data. The first of these methods is the application method to the data controller regulated in Article 13 of the KVKK. The second method is Article 14 and 15 of the KVKK. It is a way of complaining to the Personal Data Protection Board, which is stipulated in its articles.[9]

Pursuant to Article 11 of the KVKK: Everyone, by applying to the data controller;

a) To know whether or not personal data are being processed,

b) if personal data are processed, to obtain information about them

c) the purposes for which personal data are processed and whether they are used in accordance with those purposes,

to know

ç) to know the third parties to whom personal data are communicated in the country or abroad,

d) rectification of personal data in the event of incomplete or incorrect processing.

I don't want

e) the deletion of personal data or their non-existence, under the conditions provided for in Article 7.

Don't ask for it,

f) the operations carried out under letters d) and e) are the third parties to whom the personal data have been communicated.

to be informed,

g) to oppose the processing of personal data with the aid of automated systems

h) to oppose the use of personal data for the purpose of processing,

ğ) in case of damage caused by unlawful processing of personal data

demand compensation,

has the rights. The regulations regarding the use of these rights are included in Articles 13 and 14 of the KVKK. 13 of KVKK. In the article, it is stipulated that the data subjects may submit their requests regarding the implementation of the Law to the data controller in writing or by other methods to be determined by the Board, and that the data controller will conclude the requests in the application as soon as possible and within thirty days at the latest, depending on the nature of the request. On the other hand, in cases where the application made to the data controller in Article 14 of the Law is rejected, the answer given is insufficient or the application is not answered in due time; It is regulated that the person concerned can file a complaint with the Board within thirty days from the date of learning the response of the data controller and in any case within sixty days from the date of application, and that a complaint cannot be filed without exhausting the application remedy in accordance with Article 13.[10] It should be noted here that the obligation to apply to the data controller is only valid for complaints to be made to the Personal Data Protection Board.[11] Otherwise, a person who will go directly to the judiciary does not have the responsibility to apply to the data controller.[12]

On the other hand, the YSK, which carries out the task of organizing and supervising the elections, is exempt from the provisions of Article 11 of the KVKK, except for the right to demand compensation for damages, in accordance with Article 28/2 of the KVKK.

Political parties and independent candidates, who process the personal data of the voters and are deemed to be data controllers, are subject to the applications made to them due to their activities in accordance with Articles 13 and 14 of the KVKK. It has to respond in accordance with the articles and secondary regulations.[13]

When evaluating the rights of the relevant persons in terms of personal data processed specifically for the election, Law No. 6698 and the election legislation should be considered together. As a matter of fact, some rights are granted to the voter in the election legislation. For example:

- In accordance with the relevant articles of Law No. 298, the voter; Within the framework of the activities of arranging and updating the voter register, the relevant persons can request corrections and updates in terms of the information contained in the voter registers,

- Party members can apply to the party when there is a change, deficiency or inaccuracy in their personal data, and request that their personal data be updated or corrected,

- In the event that the reasons requiring the processing of personal data disappear, party members may request the destruction of their data and the notification of the transactions made to the third parties to whom the data has been transferred,

possible.[14]

Apart from these opportunities provided in the KVKK, it is also possible for the voter whose personal data has been violated to apply to the general courts. As a matter of fact, according to the third paragraph of Article 14 of the KVKK, the right of the person concerned to compensation is reserved in accordance with the general provisions. In addition, there are decisions that the claim for compensation is not examined in the complaints made to the Personal Data Protection Board and that it is necessary to apply to the general courts.[15]