WHAT IS THE CRIME OF RECORDING PERSONAL DATA?

The crime of recording personal data in Article 135 . In legal terms, this crime is defined as an offense that violates individuals' privacy and data security by unlawfully recording personal data, unlawfully processing system data, or unlawfully disclosing/disseminating recorded data to others.

The fundamental legal value protected by this crime is the right to privacy and the right of an individual to control their own data (data confidentiality), which are guaranteed by the Constitution .

Recording personal data

Article 135 - (1) Anyone who records personal data unlawfully shall be sentenced to imprisonment for one to three years.

(2) If the personal data relates to the political, philosophical or religious opinions, racial origins, moral inclinations, sexual lives, health status or trade union affiliations of individuals in violation of the law, the penalty to be imposed pursuant to the first paragraph shall be increased by half.

 

1. Material Elements and Methods of Commission of the Crime

According to the law, the crime occurs when personal data is recorded unlawfully. The key elements in practice and legal regulation are as follows:

• Definition of Personal Data: Any information relating to an identified or identifiable natural person (such as Turkish Republic identity number, name and surname, telephone number, email address, fingerprints, health information, political or religious opinions, etc.) is considered personal data.

• Unlawful Act Requirement: The recording of data must be carried out without following procedures prescribed by law, without the explicit consent of the data subject, or without legal authorization. Storing data without legal authorization or against consent is sufficient for the crime to occur.

• Special Categories of Personal Data: According to Article 135/2 of the Turkish Penal Code, relating to individuals' political, philosophical, or religious views, racial origins, unlawful moral inclinations, sexual lives, health status, or trade union affiliationsis recorded.

2. Basic Form of the Crime and Punishment

• Basic Penalty: A person who unlawfully records personal data to imprisonment for 1 to 3 years . (This penalty is increased by half if the data is classified as sensitive personal data.)

• Investigation and Prosecution: The investigation and prosecution of the basic form of this crime are not dependent on a complaint. Judicial authorities initiate investigations ex officio (on their own initiative) from the moment they become aware of the crime.

3. Other Related Data Crimes (Turkish Penal Code Articles 136 and 137)

• Disclosure or Dissemination of Personal Data (Turkish Penal Code Article 136): A person who unlawfully discloses, disseminates, or obtains personal data of others shall be punished with imprisonment from 2 to 4 years.

• Aggravating Circumstances (Turkish Penal Code Article 137): Penalties are increased if these crimes are committed through the abuse of authority granted by a public official or by taking advantage of the advantages provided by a particular profession or trade.

Is the crime of recording personal data subject to complaint?

The crime of recording personal data under Article 135 of the Turkish Penal Code is not a crime subject to complaint. Even if the victim does not file a complaint after the crime has occurred, the public prosecutor's office can initiate an investigation on its own initiative.

Statute of Limitations in the Crime of Recording Personal Data

The statute of limitations for the crime of unlawfully recording personal data is 8 years. This period begins from the date the crime was committed. If the victim does not file a complaint within this period, no investigation can be conducted and no lawsuit can be filed due to the expiration of the statute of limitations. Therefore, it is essential for the victim to report the crime to the prosecutor's office in a timely manner to avoid any loss of rights.

Suspension of the Announcement of the Verdict in the Crime of Recording Personal Data

Suspension of the Announcement of the Verdict (HAGB) is a criminal procedure institution that allows the sentence imposed on the defendant to remain in effect for a certain probationary period, and if the conditions are met, the sentence is annulled. A HAGB decision can also be made in cases of sentences for the crime of unlawfully recording personal data. In this case, if the conditions are met at the end of the probationary period, the case is dismissed and the sentence ceases to have legal consequences.

Supreme Court Decisions

1. Court of Cassation, 12th Criminal Chamber — Case No: 2022/3120, Decision No: 2023/1850

• Case Summary: The defendant was found to have illegally shared the victim's phone number, home address, and personal information on a website and social media accounts due to a dispute between them, and also stored this information in a file on a computer.

• Supreme Court Review: The Supreme Court emphasized that the unlawful recording, acquisition, and dissemination of a person's personal data constitutes the crimes defined in Articles 135 and 136 of the Turkish Penal Code. It upheld the conviction for storing and making accessible personal information in a digital environment without the defendant's consent.

2. Court of Cassation, 12th Criminal Chamber — Case No: 2021/11400, Decision No: 2022/6410

• Case Summary: The defendant is accused of illegally copying personal contact and identity information belonging to customers from the company database and saving it to an external memory device, which he then allegedly stored for other business purposes.

• Supreme Court Assessment: The Supreme Court stated that for the crime of recording personal data to occur, it is sufficient for the data to be stored unlawfully in a database or system. It upheld the local court's decision, stating that the act of unlawfully storing data by a public official or exceeding the authority/facilitation provided by their profession should be evaluated under Article 135/1 of the Turkish Penal Code and its aggravating circumstances.

3. Court of Cassation, 12th Criminal Chamber — Case No: 2023/1450, Decision No: 2023/5200

• Case Summary: A public prosecution was initiated against the defendant for the crime of recording personal data. During the trial, the victim withdrew their complaint and requested that the case be dismissed.

• Supreme Court Assessment: The Supreme Court reminded that the investigation and prosecution of the crime of recording personal data, regulated in Article 135 of the Turkish Penal Code, is not dependent on a complaint, and that it is a crime prosecuted ex officio. Therefore, it considered the written decision to dismiss the case, which failed to take into account that the victim's withdrawal of the complaint would not result in the case being dismissed, as grounds for reversal.

The Crime of Recording Personal Data: Evaluation and Conclusion

The crime of recording personal data is a critical type of crime in the digitalized world, aiming to protect the privacy of individuals' private lives, data security, and their right to control their own data (data privacy). This protection mechanism, regulated in Article 135 and subsequent provisions of the Turkish Penal Code, provides deterrent legal sanctions against unlawful data storage, processing, dissemination, and acquisition.

The key issues highlighted in practice and in the jurisprudence of the Supreme Court can be summarized under the following headings:

• Personal Data and Elements of Unlawful Act: The material element of the crime is the recording of any information belonging to an identified or identifiable natural person without legal authority or the explicit consent of the data subject. If the data is of a sensitive nature (health, sexual life, political views, etc.), the wrongful act becomes more severe and the penalties are increased.

• Dissemination, Transfer, and Professional Facilitation: In addition to the recording of personal data, the unlawful transfer or dissemination of personal data to others (Turkish Penal Code Article 136) constitutes a separate type of crime. Furthermore, committing these acts by taking advantage of professional authority or the ease provided by a public office gives rise to aggravated forms of the crime.

• Ex Officio Investigation and Public Protection: Many data crimes against freedom and privacy are investigated and prosecuted ex officio (automatically) by judicial authorities, not upon complaint. This demonstrates that data security is considered not only a matter of individual demand but also a matter of public order.

• Digital Protection of Privacy: As emphasized in judicial decisions, protecting individuals' privacy and personal data in digital environments from unlawful interference is a fundamental requirement of the rule of law. The resolute fight against this crime is vital for the preservation of individual rights and the establishment of information security.