Artificial intelligence models (LLM, image recognition, voice recognition) are trained with very large data sets. It is common for these sets to contain personal data; KVKK compliance is a critical agenda.
Anatomy of the Problem
- Name, e-mail, photo, professional information in texts collected from the web by scraping.
- Social media data (personal data, even if publicly available).
- Customer correspondence, health records, job applications.
- Face images taken with their cameras.
KVKK Compliance Framework
- KVKK article 5/1: explicit consent rule for data processing.
- KVKK article 5/2: Exceptions: law, contract, protection of rights, legal obligation, public data, establishment of rights, legitimate interest.
- The most frequently used exception for AI training: "legitimate interest" (art.5/2-f).
"Legitimate Interest" Test
The legitimate interest basis for AI training requires three stages of testing:
Public Data ≠ Free to Process
Public posting on social media does not automatically mean eligibility for processing. KVKK Article 5/2-d "publicized by the relevant person" exception is interpreted narrowly.
Anonymization
- Fully anonymous data is outside the scope of KVKK.
- Pseudonimization is insufficient.
- Anonymization must be irreversible.
- Formal guarantees such as "K-anonymity" should be preferred.
Compliance with EU AI Law
The European Union's AI Act introduces additional obligations for education data transparency and data governance. Harmonization is a must if Turkish companies operate in the EU market.
Rights of the Data Owner
- Learning that your data is being processed.
- Request to delete from training data
- Request "unlearning" from the model (technically difficult).
- Objection to automatic decision (KVKK article 11/1-h).
Board Approach (Expected)
The Personal Data Protection Board will apply a strict balancing test for the basis of "legitimate interest" in AI education data, will seek special limits in the processing of child-health-sexual orientation data, and will consider technical solutions for "right to be forgotten" requests.
Practical Tips
The intersection of AI and KVKK is complex. KVKK and IT law lawyer should work together.