KVKK Data Management Department Presidency

April 2019, ANKARA

Republic of Turkey Personal Data Protection Authority
Address: Nasuh Akar Neighborhood 1407 Street No: 4 Çankaya / ANKARA
Phone: 0.312.216 50 00
www.kvkk.gov.tr

The copying, reproduction, use, publication, and distribution of the writings and other contents in this guide, partially or entirely, without permission other than for individual use, is prohibited. Legal action will be taken against those who do not comply with this prohibition pursuant to Law No. 5846. All rights reserved.

Summary

With Article 10 of the Law on the Protection of Personal Data No. 6698, an obligation to inform the data subjects whose personal data are processed has been imposed on data controllers. The obligation to inform is a liability for data controllers but also a right for natural persons whose personal data are processed. The obligation to inform, which means providing information about the processed personal data, is an indispensable condition for the lawful execution of personal data processing. To fulfill the obligation to inform, the persons whose personal data are processed must be informed at least about the conditions listed in Article 10 of the Law. While fulfilling this obligation, the Communiqué on the Procedures and Principles to be Followed for the Fulfillment of the Obligation of Informing must be complied with. Additionally, it is beneficial to consider the suggestions, explanations, and examples included in this guide when fulfilling the obligation to inform.

Abstract

In accordance with the Article 10 of the Law on the Protection of Personal Data (Law No. 6698), the data controllers are obliged to inform the data subjects whose personal data are processed. The obligation to inform which is a liability for the data controllers, is also a right for natural persons whose personal data are processed. The informing obligation, which means giving information about the processed personal data, is an essential requirement for the lawful execution of personal data processing. In order to fulfill the obligation of informing, the persons whose personal data are processed must be informed at least as to the conditions listed in Article 10 of the Law. While fulfilling the informing obligation in question, “Communique on the Procedures and Principles to be Followed for the Fulfillment of the Obligation of Informing” must be complied with. However, it is useful to take into consideration the suggestions, explanations and examples in this guideline when exercising the informing obligation.

Keywords

  • Personal Data
  • Information Obligation
  • Data Controller
  • Data Subject
  • Open Consent
  • Data Recording System
  • Layered Notice
  • Personal Data Processing Inventory

Contents

  1. Introduction
    1. Purpose and Basis
    2. Content
    3. Definitions
  2. Scope of the Obligation to Inform
  3. Procedures and Principles to be Followed
    1. Information Obligation When Personal Data is Obtained from Data Subjects
      1. Identity of the data controller and, if any, its representative
      2. The purpose for which personal data will be processed
      3. To whom and for what purpose the personal data may be transferred
      4. The method and legal basis of personal data collection
      5. Other rights of the data subject as listed in Article 11
    2. Information Obligation When Personal Data is Not Obtained from the Data Subject
    3. Cases Where the Obligation to Inform is Not Fulfilled
  4. Relationship Between Explicit Consent and the Obligation to Inform
  5. Fulfilling the Obligation to Inform
    1. Determining the Method to Fulfill the Obligation to Inform
    2. Assigning Person(s) to Manage the Informing Process
    3. Preparation of Personal Data Processing Inventory
    4. Stages of Preparing the Information Text
  6. Examples of Information Texts
    1. Examples Compliant with the Obligation to Inform
    2. Examples Not Compliant with the Obligation to Inform

1. Introduction

Today, many companies, public institutions and organizations, foreign entities, or natural persons obtain and use a large amount of personal data within the scope of their activities, aiming to access more personal data and share it with third parties to provide better service or increase trade volume. Moving towards processing more personal data provides economic benefits due to the conveniences and advantages offered by the processed personal data but also raises various risks and potential violations related to data security.

Due to these risks and potential violations, there was a need to establish a legal infrastructure for the protection of personal data. Primarily, with the amendment made to the Constitution of the Republic of Turkey in 2010, the right to protect personal data was constitutionally guaranteed. The amendment stipulated that the procedures and principles for the protection of personal data must be regulated by law. Based on this provision, the Turkish Grand National Assembly adopted the Law on the Protection of Personal Data No. 6698 (“Law”), which was published in the Official Gazette dated 07.04.2016 and numbered 29677 and entered into force.

The Law sets out the procedures and principles to be followed by real and legal persons regarding the protection of fundamental rights and freedoms and the processing of personal data. Generally, the Law does not restrict the processing of personal data but disciplines it by binding it to certain rules. One of the most important obligations imposed on data controllers by the Law is the obligation to inform. This obligation is the most significant indicator that data subjects have control and supervision authority over their personal data. Data subjects who have supervisory authority over their personal data will also be able to determine the future of their personal data.

The obligation to inform introduced by Article 10 of the Law is a liability for data controllers but also a right for natural persons whose personal data are processed. This obligation essentially means providing information about the processed personal data and is an indispensable condition for the lawful execution of personal data processing. The obligation to inform is not dependent on the request of the data subject. If the data subject’s explicit consent or other personal data processing conditions exist, the data controller must fulfill the obligation to inform. Because the obligation to inform must be fulfilled independently of explicit consent or other personal data processing conditions in the Law.

Law Article 10

Article 10- (1) At the time of obtaining personal data, the data controller or the authorized person is obliged to inform the data subjects about;

  • The identity of the data controller and, if any, its representative,
  • The purpose for which personal data will be processed,
  • To whom and for what purpose the processed personal data may be transferred,
  • The method and legal basis of personal data collection,
  • Other rights listed in Article 11,

and provide information on these matters.

If the obligation to inform is not fulfilled, the sanction regulated in Article 18 of the Law shall be applied. The burden of proof that the obligation to inform has been fulfilled lies with the data controller. Lawful fulfillment of the obligation to inform is important for establishing a trust relationship between data controllers and data subjects, as well as for transparency and accountability principles.

1.1 Purpose and Basis

According to Article 10 of the Law, at the time personal data is obtained, the data controller or authorized persons must inform the data subjects. Pursuant to this provision and subparagraph (e) of the first paragraph of Article 22 of the Law, the Personal Data Protection Board (“Board”) prepared the Communiqué on the Procedures and Principles to be Followed for the Fulfillment of the Obligation of Informing (“Communiqué”), which was published in the Official Gazette dated 10 March 2018 and numbered 30356. Based on this Communiqué, the Board prepared the “Guide to Fulfilling the Obligation of Information” (“Guide”) to clarify how this obligation should be fulfilled in practice and to provide good practice examples, and made it available to the public for information and benefit.

1.2 Content

The Guide’s;

  • First section is the introduction, which includes the purpose, basis, content, and definitions of the guide.
  • Second section covers the scope of the information obligation to be provided by the data controller or authorized persons to the data subjects.
  • Third section specifies the procedures and principles to be followed when fulfilling the obligation to inform.
  • Fourth section addresses the relationship between explicit consent and the obligation to inform.
  • Fifth section discusses the stages related to fulfilling the obligation to inform.
  • Sixth section shares examples of compliant and non-compliant practices within the scope of the obligation to inform.

1.3 Definitions

  • Recipient group: The category of real or legal persons to whom personal data is transferred by the data controller,
  • Data subject: The natural person whose personal data is processed,
  • Law: The Law on the Protection of Personal Data No. 6698 dated 24/3/2016,
  • Layered notice: Providing preliminary information to the data subject at the time of obtaining personal data and directing the data subject to the information in accordance with Article 10 of the Law,
  • Board: Personal Data Protection Board,
  • Authority: Personal Data Protection Authority,
  • Registry: Data Controllers Registry kept by the Presidency,
  • Data Recording System: The record system in which personal data is structured and processed according to certain criteria,
  • Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system,
  • Data controller representative: A legal person established in Turkey or a natural person who is a Turkish citizen, authorized at least for representation in the matters specified in the third paragraph of Article 11 of the Regulation on Data Controllers Registry published in the Official Gazette dated 30/12/2017 and numbered 30286, representing data controllers not established in Turkey.

Definitions not included in this Guide shall be governed by the definitions in the Law and the Communiqué.

2. Scope of the Obligation to Inform

The obligation to inform is imposed on real and legal person data controllers who process personal data within the scope of their activities. Therefore, the obligation to inform covers data controllers.

The obligation to inform is not dependent on the request of the data subject. If the data subject’s explicit consent or other personal data processing conditions exist, the data controller must fulfill the obligation to inform. Because the obligation to inform must be fulfilled independently of explicit consent or other personal data processing conditions in the Law. The burden of proof that the obligation to inform has been fulfilled lies with the data controller. The general principles in Article 4 of the Law should be considered when fulfilling the obligation to inform.

3. Procedures and Principles to be Followed

3.1. Information Obligation When Personal Data is Obtained from Data Subjects

According to the Law, at the time of obtaining personal data, the data controller or authorized persons must inform the data subjects. According to Article 10 of the Law, which contains provisions regarding the obligation to inform, the information provided by the data controller or authorized persons to the data subjects must at least include the following conditions:

3.1.1. Identity of the data controller and, if any, its representative

The data controller and, if any, its representative must disclose their identity information and contact details that allow easy communication by different methods during the informing process. For example, if the data controller is a legal entity, the trade name of the legal entity; if a natural person, the full name; if the data controller is established abroad, the name/title of the appointed data controller representative, along with contact information such as phone number, email address, website address, or postal address, should be specified.

3.1.2 Purpose for which personal data will be processed

According to the first paragraph of Article 5 of the Communiqué, when fulfilling the obligation to inform, the processing purpose must be specific, clear, and legitimate. Additionally, the information should avoid general, vague expressions that may give the impression that personal data could be processed for other potential purposes.