In Türkiye, personal data is protected in two separate legal frameworks: TCK no. 5237 art.135-138 (criminal liability) and Personal Data Protection Law no. 6698 - KVKK (administrative liability and data controller obligations). This article discusses the regulation within the scope of criminal law and also touches upon its connection with KVKK.
What is Personal Data?
Any information regarding a specific or identifiable natural person is personal data. Examples:
- Name, surname, T.R. identification number
- Phone number, home address, e-mail
- Bank account information, IBAN
- Health data, blood type, diseases
- Ethnicity, religion, sect, political opinion, union membership (special quality data)
- Location information, IP address, cookie data
- Photo, video, audio recording (as long as it makes the person identifiable)
Unlawful Recording of Personal Data (TCK Article 135)
A penalty is imposed on "anyone who records personal data unlawfully". According to the legislation, the penalty range is from 1 to 3 years of imprisonment.
Qualified Circumstances (TCK art.135/2)
The personal data that is the subject of the crime may be based on political, philosophical or religious views, racial origins; If it is related to unlawful moral tendencies, sexual life, health conditions or union connections, the penalty is increased by half.
Illegally Giving or Seizing Data (TCK Article 136)
A penalty is foreseen for "the person who unlawfully gives, disseminates or obtains personal data to another person"; According to the legislation, it is in the range of 2 to 4 years imprisonment.
Qualified Case (TCK art.136/2)
If the subject of the crime is data that must be eliminated or destroyed in accordance with the provisions of the Code of Criminal Procedure, the penalty to be imposed is increased by one fold.
Not Destroying Data (TCK Article 138)
It is a separate type of crime applied to those who are obliged to destroy data within the system even though the periods stipulated by law have expired, when they fail to fulfill their duties; According to the legislation, punishment ranges from 1 to 2 years of imprisonment.
"Legal Compliance" Reasons
Processing personal data does not constitute a crime in all cases. The processing is considered lawful in the following cases (KVKK article 5):
- Explicit consent of the person
- Clearly prescribed by law
- Directly related to the establishment or execution of the contract
- Compliance of the legal obligation of the data controller
- It is mandatory for the establishment, use or protection of a right
- It is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned
- It has been made public by the person concerned
Frequently Encountered Scenarios in Practice
- Ex-lover/spouse sharing private photos or videos on social media (revenge pornography)
- Sharing a neighbor's ID or illness information in the apartment WhatsApp group
- Sharing of candidate health reports by the employer with others
- Publishing information such as the address and telephone number of the person being reported on in the newspaper or on the website
- Sharing the divorce party's e-mail correspondence or WhatsApp messages with others as screenshots
- Leak of health information obtained in a hospital, clinic or doctor's office
- Bringing customer lists from the old workplace to the new workplace
- Sharing employee information such as performance and salary in internal e-mail groups
Relationship with KVKK
TCK articles 135-138 regulate criminal liability, and KVKK regulates administrative and private law liability. The same action may lead to both a criminal investigation and the imposition of an administrative fine by the Personal Data Protection Board (KVKK Board). Administrative fines that the KVKK Board can impose can reach millions of liras.
Applications that the victim can apply:
Complaint and Investigation
TCK Article 135-138 crimes are crimes that are prosecuted ex officio; The victim's complaint is not mandatory. However, in practice, the victim's active application is of great importance in order to provide evidence and speed up the process.
Jurisdictional and Competent Court
- Officer: Criminal Court of First Instance (since the upper limit of the sentence does not exceed 5 years).
- Authority: The court of the place where the crime was committed (CMK article 12). In crimes committed over the internet, the court of the victim's residence may also be considered competent.
Personal Data Disclosure on Social Media
For disclosures made on platforms such as Twitter/X, Instagram, Facebook, TikTok:
- Screenshots (with time stamp, URL) must be notarized
- Content removal request may be requested from the court within the scope of Article 9 of Law No. 5651
- Access blocking decisions made in criminal judgeships of peace are implemented in a short time
- Direct content delivery to the platform should also be executed in parallel