Deletion, Disposal or Anonymization of Personal Data in Turkey
Data protection has become a significant concern due to the increased use of technology. Turkey took its shape in this progress and enacted several legislations in order to establish the fundamentals of data privacy and not to be left behind the international standards.
In our previous article on data protection, “Data Protection; Progresses Non-Stop in Turkey” we informed you on the enactment of the Law on Protection of Personal Data (came into force on April 7, 2016) (“Law”). The Law filled a big gap in Turkey for the application of data protection. Since then, two regulations have been enacted on the implementation of the law and addressing on the application of data privacy concerns.
I. To Delete, Dispose or Anonymise the Personal Data
On October 28, 2017, the Regulation on the Deletion, Disposal or Anonymization of Personal Data numbered 30224 (“Regulation 30224”) was published. The Regulation 30224 is applicable on the data responsible, who is entitled to determine the purpose of processing the personal data; and monitor the public Data Responsible Registry, at which the data responsible must be registered. The aim of the Regulation 30224 is to determine the procedures and principles applicable on the deletion, disposal or anonymization of personal data, automatic or non-automatic means, processed either completely or in part, provided that it is a part of a data registration system.
Under the Regulation 30224, in the event that a personal data is deleted, such personal data will no longer be available to anyone and can no longer be used by anyone and in any case. Anonymizing personal data refers to personal data which can no longer be associated with anyone, whose identity is specific or specifiable.
Policy to Keep, Dispose Data
According to the Law, the data responsible is obliged to establish and maintain a policy to keep and dispose personal data. However, the Regulation 30224 states that, having such policy does not always mean a personal data is kept or disposed in line with the provisions of the relevant regulations and the Law, when they are kept or disposed. In Article 6 of the Regulation 30224, the scope of the policy is broadly explained and accordingly, it mainly states that keeping and disposing of personal data and the measures taken for the occurrence of such actions must be legal.
Methods to Delete, Dispose or Anonymise Personal Data
The Law provides for certain conditions to process the personal datas, which can be processed in the absence of explicit consent of the person whose data is processed and sensitive data as explained in the Law. According to the Regulation 30224, in case the conditions are no longer available for the processing of such, then the data responsible must delete, dispose or anonymise those data ex officio or on the request of the owner of the data When deleting, disposing or anonymizing a personal data, the data responsible must act in accordance with the general principles, technical and administrative principles, commission’s decisions (as described herein below) and the policy of keeping and disposing the data. Furthermore, the data responsible is responsible to explain the method, policy and procedures utilized when disposing, deleting or anonymizing the data.
When to Delete, Dispose or Anonymise the Personal Data
Pursuant to the Regulation 30224, the data responsible must determine on a time period to delete, dispose or anonymise the personal data periodically. The data responsible must delete, dispose or anonymise such data in intervals which in any case cannot exceed six (6) months following the occurrence of the obligation and/or need for the deletion, disposal and anonymization of the same. The commission, which is the authorized body under Article 13 of the Regulation 30224 in order to determine the methods and principles and take measures, if necessary, in case any data responsible hesitates on how to apply any of the provisions of the Regulation 30224 (“Commission”), can shorten such period if it deems necessary.
In case the personal datas are to be deleted, disposed or anonymized on the request of the person owning the personal data, then the time periods can be shortened as stated in the Regulation 30224.
II. Hesitation to Apply the Regulation 30224, Authorization and Duties of the Commission
At the time the Regulation 30224 was published, no legislation piece setting forth the working procedures and principles of the Commission existed except for the general ones provided in the Law. Accordingly, no gap will be available in terms of the working procedures of the Commission, because the Regulation on the Working Procedures and Principles of the Personal Data Protection Commission is published and has entered into force on November 16, 2017 and the Regulation 30224 will enter into force on January 1, 2018.
By the virtue of the foregoing regulations, the procedures on to deleting, disposing and anonymizing personal data have been clarified, and the scope of the authority of the Commission is specified. As an outcome of its substantial efforts, Turkey keeps the pace with the international standards with regards to the protection of personal data.
ABOUT THE AUTHOR: Ms. Serap Zuvin and Ms. Aybala Kurtuldu
Ms. Serap Zuvin is the founding partner of Serap Zuvin Law Offices. Ms. Zuvin has specialized on corporate finance. She has been extensively involved in various cross-border joint ventures and mergers and acquisitions. She has established the subsidiaries and/or representative offices of multinational companies in Turkey.
Ms. Aybala Kurtuldu is an associate lawyer at our office. Ms. Kurtuldu focuses on corporate and commercial law, aviation law. Ms. Kurtuldu provides legal assistance to aviation clients in cross border loan and lease financing, sales and purchase transactions.
Copyright Serap Zuvin Law Offices
More information about Serap Zuvin Law Offices
Disclaimer: While every effort has been made to ensure the accuracy of this publication, it is not intended to provide legal advice as individual situations will differ and should be discussed with an expert and/or lawyer. For specific technical or legal advice on the information provided and related topics, please contact the author.