Personal Data Protection Law (KVKK)

Conditions for processing personal data

ARTICLE 5 - (1) Personal data cannot be processed without the explicit consent of the data subject.

(2) In the presence of one of the following conditions, it is possible to process personal data without the explicit consent of the data subject:

a) If explicitly provided for in the laws.

(b) It is necessary for the protection of the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent is not legally valid, or for the protection of the life or physical integrity of another person.

c) The processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

c) It must be necessary for the data controller to fulfill its legal obligations.

d) It must have been made public by the person concerned themselves.

e) Data processing is necessary for the establishment, exercise, or protection of a right.

f) The processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Article 20/3 of the Turkish Penal Code - However, the protection of personal data is a fundamental right, and its restriction requires the consent of the individual or a legal basis, as provided for in cases stipulated by law or  with. 

PROCESSING PERSONAL DATA IS PROHIBITED AS A RULE.

Article 5 of the law sets out the conditions under which personal data may be processed, i.e., the exceptions to the prohibition. 

In terms of compliance, not only Article 5 of the Personal Data Protection Law (KVKK) but also Article 4, which contains the fundamental principles of Article 5, should be taken into account. 

 Explicit Consent 

The processing of personal data is, as a rule, subject to explicit consent. In this sense, there is no distinction between personal data and special categories of personal data. Furthermore, transfer and, under Articles 8 and 9, transfer abroad are also subject to explicit consent.  Explicit consent is a legal act.

 KVKK Article 3 1 a) Explicit consent: This refers to consent given freely and based on informed knowledge regarding a specific matter.

Explicit consent must be obtained before data processing begins. Consent obtained after the processing activity will only be considered technical approval and will not legitimize the data processing.

a) As Clearly Seen by the Law

Accordingly, personal data may be processed if there are explicit regulations on the subject in laws other than the KVKK (Law on the Protection of Personal Data). 

Taking fingerprints of suspects is an example of this , as per Article 5 of Law No. 2559 on the Protection of Personal Data, when law enforcement investigates a crime .  

(b) When a person is unable to express their consent due to factual impossibility or
when their consent is not legally valid, and it is necessary for the protection of their own life or the life or physical integrity of another person.

In cases where consent cannot be expressed or is not valid, personal data may be processed only if it is necessary for the protection of the life or physical integrity of individuals. 

For example, in situations where a person's consent is not valid due to their lack of consciousness or mental illness, personal data may be processed during medical intervention for the purpose of protecting their life or physical integrity. 

Furthermore, in order to secure the release of a person whose liberty is restricted, necessary personal data may be processed to determine their location via a telephone, computer, credit card, bank card, or other technical device carried by the person or suspect

c) The processing of personal data of the parties to a contract is necessary provided that it is directly related to the establishment or performance of the contract

Personal data may be processed provided it is directly related to the establishment or performance of a contract. For example, the account number of a creditor may be obtained in order to make a payment as per a contract. Similarly, when a bank enters into a loan agreement, obtaining the person's payslip, property records, or a document stating that there are no outstanding debts would be considered within this scope.

of address information processed when purchasing a product online .

c) It is necessary for the data controller to fulfill its legal obligations

The data controller may process data that is necessary to fulfill its legal obligations, even without the consent of the data subject.

 For example, a company needing to process data such as bank account number, marital status, dependents, spouse's employment status, and social security number in order to pay an employee's salary would be considered within this scope.

d) It must have been made public by the person concerned themselves

Personal data that has been made public by the data subject themselves, in other words, that has been disclosed to the public in any way, can be processed without explicit consent. In this case, it is assumed that the legal interest that needs to be protected has ceased to exist.

By making it public, we mean making it known to everyone.

e) Data processing is necessary for the establishment, exercise or protection of a right

An example of a guardian or trustee holding a person's financial information to protect their rights is..

f) The processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Personal data may be processed without explicit consent if it is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. For example, a company owner may process personal data for purposes such as employee promotions, salary increases, or the regulation of social benefits, provided that it does not harm the fundamental rights and freedoms of their employees. In this case, compliance with the fundamental principles of personal data protection and the balance of interests between the data controller and the data subject are necessary. Human rights should be interpreted broadly, with exceptions narrowly applicable.

The Importance of the Lawyer

1. Prevents the copy-paste (ready-made text) trap.

3. Secures Contracts and Supplier Relationships