What is the Personal Data Protection Law?
With the advancement of technology today, both government institutions and private organizations can easily access, process, and store individuals’ personal data. This situation can negatively affect people’s lives and threaten their security. To prevent potential negative consequences, the need for a Personal Data Protection Law has arisen. The protection of personal data is directly related to the fundamental human right of privacy. To ensure the confidentiality of individuals’ private lives, data that should not fall into the hands of third parties must be legally protected. The main factors that led Turkey to prepare a legal regulation regarding the protection of personal data include the effective protection of human rights, the EU membership negotiations, and the need to enhance international cooperation and trade.
The Constitution also states that detailed regulations regarding the protection of personal data shall be enacted by law. Within this framework, the “Draft Law on the Protection of Personal Data” was submitted to the Turkish Grand National Assembly on December 26, 2014. The draft law was enacted on March 24, 2016, and the Personal Data Protection Law No. 6698 was published in the Official Gazette on April 7, 2016, issue number 29677, and came into force. The purpose of the law is to regulate the processing of personal data and to protect fundamental rights and freedoms, especially the right to privacy, as stipulated in the Constitution. No distinction is made between private institutions and government institutions under the law. The law applies to both natural persons whose personal data is processed and to real and legal persons who process these data. All principles and procedures determined by the law are valid for all institutions. The law states that only personal data belonging to natural persons fall within its scope. Therefore, as a principle, the protection of personal data belonging to legal entities is not included within the scope of Law No. 6698. However, if obtaining data belonging to a legal entity allows for the identification of one or more natural persons, such data may also be protected under the law. Exceptions include cases such as processing personal data for official statistics or official research, processing for artistic, literary, or scientific research or freedom of expression without constituting a crime, and processing by judicial and enforcement authorities.
In conclusion, this law aims to regulate under which rules and conditions personal data can be processed. By introducing supervisory mechanisms for the processing of personal data, it seeks to prevent the unlawful processing of such data.