Legal Consequences of Sharing Employee Information with a Competitor: Liability and Right to Damages for the Person Sharing the Information

Entrance

When a company employee or human resources manager shares employee information such as salary, bonuses, benefits, performance, job applications, promotions, terminations, health, discipline, or career plans with a competitor, it is not simply a matter of a confidentiality breach involving a single area of ​​law.

The same behavior depending on the specifics of the case;

• Information exchange that violates Law No. 4054 on the Protection of Competition,
• Data transfer that violates the Law No. 6698 on the Protection of Personal Data,
• Violation of the worker's personal rights,
• Disclosure of the employer's trade or business secrets,
• Breach of the employee's duty of loyalty and confidentiality,
• Unfair competition under the Turkish Commercial Code
• Under the Turkish Penal Code, unlawfully disclosing personal data or revealing trade secrets

It may possess this quality.

Therefore, when determining responsibility, it is first necessary to ascertain what information was transmitted, by whom, for what purpose, to whom, in what manner, and on what legal basis.

1. Scope of the Employee Information Concept

As a rule, any information relating to an employee that is identified or identifiable as a natural person constitutes personal data.

In this context, the following information is specifically considered personal data:

• First and last name,
• Phone number and email address,
• Job and title,
• Salary and wage information,
• The amount of bonuses and incentives,
• Fringe benefits,
• Performance evaluations,
• Discipline information,
• Employment start and end dates,
• Information about a job application
• Curriculum Vitae,
• Reference information,
• Promotion or dismissal plans,
• Health and disability information,
• Union membership,
• Criminal record information.

Since health information, biometric data, union membership information, and similar details are considered special categories of personal data, their transfer is subject to stricter conditions.

From a competition law perspective, it is important that the information is not only personal data but also has the potential to influence competitors' employment and wage policies. Future salary increases, position-based wage ranges, bonus systems, recruitment budgets, and employee transfer plans can be considered competition-sensitive information. The Competition Authority's Labor Market Guidelines consider information relating to wages, benefits, working hours, leave, social assistance, and other working conditions as parameters of competition in the labor market.

2. Is Sharing Employee Information Illegal?

Sharing employee information with a competitor is not always illegal. However, for it to be legal, the sharing must be based on a clear and valid legal reason.

For example;

• The employee's explicit consent is required
• Fulfilling a legal obligation,
• The transfer of rights is necessary for the establishment, exercise, or protection of a right
• It must be directly related to the establishment or performance of an employment contract
• where necessary for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights of the data subject

Legal grounds such as these may justify data transfer in certain circumstances.

However, the fact that personal data has been lawfully obtained by the company does not automatically mean that it can be transferred to a competitor. Domestic data transfers must also meet one of the personal data processing conditions stipulated in the KVKK (Turkish Personal Data Protection Law).

Excuses such as "that's how it's done in the industry," "it was shared for reference checking purposes," "the two company executives knew each other," or "it wasn't intended to harm the employee" do not, by themselves, guarantee legal compliance.

3. Sharing Employee Information from a Competition Law Perspective

3.1. Article 4 of Law No. 4054

Article 4 of Law No. 4054 prohibits agreements and concerted actions between undertakings that aim to prevent, distort, or restrict competition, or that have or may have such an effect.

Sharing information on employee wages, raise rates, bonuses, benefits, and future human resources policies among competing employers can hinder independent decision-making among businesses.

Information sharing, especially;

• Its future-oriented nature,
• It should be up-to-date and customizable on a company basis
• Regular repetition,
• To be carried out mutually,
• To be used in salary or recruitment decisions,
• Its aim is to suppress employee wages,
• Restricting employee transfers

It increases the risk of anti-competitive practices.

In its decision dated September 11, 2025, regarding the pharmaceutical sector, the Competition Board determined that some undertakings had engaged in the exchange of competitively sensitive information about employee salaries and benefits for future periods, and imposed a total administrative fine of 244,801,302.91 TL on the undertakings subject to the investigation.

Therefore, the sharing of employee information among competitors can be examined not only as a violation of the Personal Data Protection Law, but also as a violation of competition law that facilitates wage coordination in the labor market.

3.2. Personal liability for administrative fines of the person sharing the information

In competition law, administrative fines are primarily imposed on the undertaking. However, personal penalties may also be imposed on managers or employees whose decisive influence in the violation is determined.

In accordance with Article 16 of Law No. 4054 and the Penal Regulation dated December 27, 2024, a personal administrative fine of up to 5% of the administrative fine imposed on the undertaking may be applied to the manager or employee who had a decisive influence in the violation.

For this responsibility to arise, it is not always sufficient for a person to have technically transmitted an email containing information. The person must also:

• Initiating the exchange of information,
• Maintaining regular communication with the opponent,
• Preparing the data to be shared,
• Instructing other employees to share information,
• Using shared data in pricing decisions,
• Ensuring the continuation of the application

It is expected to assume a decisive role, such as this.

Human resources managers, compensation and benefits managers, general managers, or company executives may therefore be at risk of personal sanctions.

4. Responsibility under the Personal Data Protection Law (KVKK)

4.1. Responsibility of the data controller company

The employer who processes employee information is, as a rule, the data controller. If a company employee unlawfully shares personal data while performing their duties, the administrative responsibility under the Personal Data Protection Law (KVKK) usually falls on the data controller company.

Data controller;

• To prevent unlawful data processing,
• Blocking unlawful access,
• Storing data securely,
• Training its employees,
• Limiting their powers,
• To carry out the necessary checks

It is necessary.

The Personal Data Protection Board acknowledges that if a company employee unlawfully publishes or transfers personal data to third parties, the data controller company may be subject to administrative fines if it has not taken adequate technical and administrative measures.

4.2. The employee's status under the Personal Data Protection Law (KVKK) regarding the sharing of information

If a company employee is acting in accordance with the employer's instructions and defined objectives, they are not normally a separate data controller. In this case, the administrative fine under the Personal Data Protection Law (KVKK) is usually imposed on the employer company.

However, the employee;

• If they used the data for their personal gain,
• If he/she has exceeded his/her authority,
• If he transferred it to the opponent for an independent purpose of his own choosing,
• If they have sold the data or received any benefit in return,
• If a personal data system has been established without the employer's knowledge

In this specific case, they may become an independent perpetrator of personal data processing activities. Furthermore, they may face disciplinary, compensation, and criminal liability.

In public institutions, disciplinary measures can be applied to personnel in accordance with Article 18 of the Personal Data Protection Law (KVKK). The Personal Data Protection Board decided to initiate disciplinary proceedings against the responsible personnel in a case where employees' leave information at a university was shared with unauthorized personnel.

5. Criminal Law Liability

5.1. The crime of unlawfully disclosing personal data

Providing an employee's personal data to a competing firm without a legal basis may, if the conditions are met, constitute the crime of unlawfully disclosing or disseminating personal data as defined in Article 136 of the Turkish Penal Code.

In terms of crime;

• The shared information is personal data,
• Giving or disseminating information to another person,
• The transfer being illegal,
• The perpetrator acted intentionally

is necessary.

The perpetrator of this crime is the individual who actually shared the information. The company cannot be sentenced to imprisonment in the same way; however, under the conditions stipulated by law, security measures specific to legal entities may be considered.

Not every violation of personal rights automatically constitutes a crime under Article 136 of the Turkish Penal Code. Indeed, in the case subject to the Personal Data Protection Board's decision numbered 2022/798, the transfer of information about a job interview to the current employer was found to be contrary to the Personal Data Protection Law; although the criminal investigation concluded that there was no element of crime, it was accepted that the transfer may be unlawful under private law and the Personal Data Protection Law.

Therefore, the absence of a penalty does not mean that the act complies with the Personal Data Protection Law or that there is no liability for compensation.

5.2. Disclosure of trade secrets, business secrets or customer secrets

If the shared information is not merely personal data relating to an employee, but also includes the company's confidential wage policy, future personnel budget, organizational plan, or strategic recruitment system, then Article 239 of the Turkish Penal Code may also come into play.

A person who discloses trade secrets learned in the course of their duties or profession to an unauthorized person may be held criminally liable upon complaint. The Personal Data Protection Board also states that the unlawful data sharing in this specific case can be evaluated under both Article 136 of the Turkish Penal Code and, due to the nature of the secret, Article 239.

Not all salary information is inherently a trade secret. However, a company's non-public, commercially valuable salary scales and future salary strategies, which are kept confidential, may be considered trade secrets.

6. The Responsibility of the Employee Sharing Information from the Perspective of Labor Law

6.1. Breach of the duty of loyalty and confidentiality

According to Article 396 of the Turkish Code of Obligations, an employee is obligated to act faithfully in protecting the legitimate interests of the employer. An employee may not use production and business secrets learned during their employment for their own benefit or disclose them to others. This obligation to maintain confidentiality may continue even after the termination of the employment relationship, to the extent required by the employer's legitimate interests.

Therefore, the human resources employee;

• Salary tables,
• The bonus system,
• Future wage increase rates,
• Employee transfer plans,
• Performance reports,
• The layoff lists,
• Hidden changes in the organizational chart

Sharing this information with a competitor could constitute a breach of the duty of loyalty and confidentiality.

6.2. Termination of the employment contract for just cause

Article 25/II-e of the Labor Law No. 4857 grants the employer the right to terminate the employment contract immediately for just cause in cases of abuse of trust, disclosure of trade secrets, and conduct contrary to honesty and loyalty.

However, the severity of the specific case must be assessed in terms of termination. The nature of the shared information, the employee's role, intent, the scope of the sharing, the risk incurred by the company, and the disciplinary policy applied in similar cases should be considered.

Not every erroneous email transmission or oversight automatically constitutes grounds for justified termination. However, the deliberate and systematic disclosure of confidential information to a competitor, especially if done in exchange for personal gain, constitutes a strong reason for justified termination.

6.3. The employer's right to compensation against the employee

According to Article 400 of the Turkish Code of Obligations, an employee is liable for damages caused to the employer through their fault. The scope of liability is determined by considering factors such as whether the work requires specialized expertise, the employee's training, qualifications, and the level of care that can be expected of them.

The employer may claim the following damages from the employee who shared the information:

• Commercial loss incurred due to a competitor's use of information,
• Damage resulting from the mass departure of employees,
• Restructuring costs incurred due to the disclosure of the hidden fee system,
• Reasonable expenses incurred to investigate and contain the data breach,
• Compensation paid to customers or employees,
• The costs that the employer has to pay to third parties,
• Damages resulting from administrative sanctions, if the conditions are met.

However, it cannot be said that the employer can automatically recover all administrative fines imposed by the Competition Board or the Personal Data Protection Authority from the employee. The employer's own organizational, supervisory, and training deficiencies; and the management's failure to take precautions despite knowing about the instruction or violation may reduce or eliminate the possibility of recourse.

An employer can only seek recourse against an employee for compensation paid to the extent that the employee is personally liable. Article 66 of the Turkish Code of Obligations also stipulates that an employer may be held responsible for damages caused by an employee to third parties during the performance of work, and may subsequently seek recourse against the employee in proportion to their fault.

7. Unfair Competition Liability

Sharing employee information may, in some cases, constitute unfair competition under the Turkish Commercial Code.

Article 55 of the Turkish Commercial Code;

• Encouraging employees to disclose their employers' production and business secrets,
• Benefiting from trade secrets obtained illegally,
• Unlawfully disclosing trade secrets to others

It is considered among the prime examples of unfair competition.

In this case, the injured party is the employer;

• Determining unfair competition,
• Stopping the act,
• Eliminating the consequences,
• Monetary compensation,
• If the conditions are met, compensation for non-pecuniary damages
• The announcement of the verdict,
• Interim injunction

can request.

Article 56 of the Turkish Commercial Code allows for compensation for damages and losses in cases of fault, and for moral damages in cases of injury to personal rights. In some cases, the court may also award compensation for the benefit that the defendant could have obtained as a result of unfair competition.

If an employee of a competing company has encouraged the disclosure of confidential information, offered money or benefits, or used information they knew to have obtained illegally, not only the person who shared the information but also the competing company and its relevant executives may be held liable.

8. Does the employee have the right to compensation?

8.1. General principle

An employee whose personal information is shared with a competing company may be entitled to compensation. However, the right to compensation does not automatically arise in every instance of data sharing.

As a rule, the employee should present the following:

1. That information belonging to him/her was shared,
2. The post was illegal,
3. that he/she has suffered material or moral damage,
4. There is a proper causal link between the sharing and the harm,
5. The defendant is at fault or legally liable.

According to Article 49 of the Turkish Code of Obligations, a person who causes harm to another through a culpable and unlawful act is obligated to compensate for that harm. In cases of damage to personal rights, moral damages can be claimed pursuant to Article 58 of the Turkish Code of Obligations.

8.2. Monetary compensation

The employee may claim the following financial losses:

• The wages lost due to the illegal sharing,
• Loss of income due to dismissal or unpaid leave,
• Tangible profit lost due to not being hired by a competing firm,
• Losing a higher-paying job opportunity,
• Hindering career development,
• Mandatory expenses incurred for legal and technical protection,
• Health or medical expenses,
• Other economic losses resulting from the misuse of personal data.

For example, informing a candidate's current employer that they are interviewing with another company, and consequently placing the employee on unpaid leave, necessitates an investigation into the link between financial loss and data sharing. In its decision numbered 2022/798, the Turkish Personal Data Protection Law (KVKK) deemed similar data transfers unlawful and imposed an administrative fine on the data controller.

However, the mere fact that "profit was shared" does not necessarily indicate the existence of quantifiable financial loss. The plaintiff should document, to the extent possible, the loss of income and the missed opportunity.

8.3. Non-pecuniary damages

If an employee's salary, performance, health status, disciplinary history, or job search information is shared with a competitor without their permission, this may constitute a violation of their right to privacy and personal integrity.

In this case, the employee;

• Violation of privacy,
• Damage to professional reputation,
• Being humiliated in the workplace,
• His career is at risk,
• Being subjected to employer pressure,
• Experiencing intense anxiety and restlessness

For these reasons, they can claim compensation for non-pecuniary damages.

Dismissal from work or a tangible loss of income is not necessarily required for compensation for non-pecuniary damages. However, the court will assess the severity of the violation, the nature of the data, the scope of the sharing, the number of recipients, the perpetrator's intent, and the impact of the event on the victim.

8.4. From whom can compensation be claimed?

The compensation claim depends on the specifics of the case;

• The data controller shall inform the employer,
• To the employee or manager who actually shared the information,
• To a competing firm that requests or uses the information,
• To the responsible manager of the competing company,
• To all those responsible who acted together

It can be directed.

An employer may be held liable under Article 66 of the Turkish Code of Obligations for damages caused by an employee to a third party in the performance of assigned work. The person sharing the information is also personally liable for their own negligent wrongful act. Joint and several liability may arise if more than one person causes the same damage.

9. Can the Personal Data Protection Board Award Compensation?

The Personal Data Protection Board is not a court that awards material or moral damages.

Article 14, paragraph 3 of the KVKK (Law on Protection of Personal Data) states that individuals whose personal rights have been violated retain the right to compensation according to general provisions. In its decision numbered 2020/43, the Board explicitly acknowledged that compensation claims should be brought before general courts and that the Board does not have the authority to award compensation.

Therefore, the employee said the following regarding the same incident:

• GDPR application to the data controller
• Complaint to the Personal Data Protection Board,
• A criminal complaint was filed with the public prosecutor's office
• Lawsuit for material and moral damages

They can pursue these methods separately.

The imposition of an administrative fine by the board does not automatically mean that the employee will receive the payment directly. Administrative fines are paid to the public treasury. The employee must also claim compensation for their own losses.

10. Compensation for Violation of Competition Law

If the sharing of employee information constitutes not only an individual data breach but is also part of wage coordination between competing employers, then Articles 57 and 58 of Law No. 4054 may also be applied.

Article 57 of Law No. 4054 grants individuals who have suffered damages due to actions, decisions, or agreements restricting competition the right to claim compensation for their losses. Joint and several liability may arise if more than one person has caused the damage.

The employee can, for example;

• His salary was below competitive levels because rival companies were sharing his salary information
• Wage increases were limited in a coordinated manner,
• Competitors have jointly lowered the amounts of their job offers,
• Sharing information prevented opportunities for changing jobs

He can claim.

However, calculating damages in a competition violation lawsuit is quite difficult. The difference between the employee's potential wages if the competition violation had not occurred and the wages they actually received may need to be determined through expert assessment.

Triple compensation

According to Article 58 of Law No. 4054, if the damage resulted from an agreement or decision of the parties, or from gross negligence, the court may, upon the request of the injured party, award compensation in an amount equal to three times the calculated damage.

Triple compensation is not automatic. For this to happen:

• A competition violation contrary to Law No. 4054,
• The plaintiff suffered direct or indirect harm as a result of this breach,
• Amount of damage,
• Appropriate causal link,
• Fault or agreement conditions required by law

It must be proven.

Sharing an employee's personal information in a one-time, non-competitive manner may not be sufficient grounds for triple compensation. However, if competing companies systematically exchange data to coordinate future wages, then antitrust damages may arise.

11. Employer's Right to Compensation

Sharing employee information can also harm the employer's economic interests.

The employer may claim compensation in the following cases:

• The disclosure of the company's confidential wage policy to a competitor,
• The competitor's targeted transfer of key employees,
• Unveiling the human resources strategy,
• The use of personnel budget by a competitor,
• The company has suffered a loss of trust among its employees,
• Compensation for employees due to data breaches,
• Losing customers or employees due to unfair competition.

The claim may be directed at the employee who shared the information, the competing firm that obtained the information illegally, or individuals acting in concert with them.

However, the employer must also consider their own fault. Granting employees excessively broad access, lack of supervision, absence of a confidentiality policy, and failure to provide competition law training can all be taken into account in determining the amount of compensation and the scope of recourse.

12. Responsibility of the Competitor Company

A competing company that receives the information cannot escape liability in all cases simply because it is a passive recipient.

The competitor's liability is particularly strengthened in the following cases:

• His/Her explicit request for information,
• Offering benefits to an employee,
• Establishing a regular flow of information,
• Knowing that the information is confidential,
• Using the data in its payroll or hiring policies,
• Encouraging employees to reveal trade secrets,
• Recording and storing data without a legal basis,
• The exchange of information should be reciprocal.

A competing company may become a separate data controller under the Turkish Personal Data Protection Law (KVKK) the moment it begins processing employee data for its own purposes. Therefore, not only the sender of the data but also the party that unlawfully receives, uses, and stores it may be held liable.

From a competition law perspective, an undertaking that does not explicitly object to the unilaterally sent strategic information, or that uses or responds to the data, may be considered to have participated in the information exchange.

13. Means of Proof

In disputes regarding the sharing of employee information, the following evidence may be important:

• Emails,
• WhatsApp and other messaging logs,
• Salary and benefits tables,
• File submission records,
• Computer access logs,
• Meeting notes,
• Recordings of meetings with a competitor company,
• Job application forms,
• Notices of termination and warnings,
• Personal Data Protection Law (KVKK) applications and responses
• Data breach notifications,
• Witness accounts,
• Decisions of the Competition Board or the Personal Data Protection Authority,
• Expert examinations.

Evidence should not be obtained through unlawful means. In particular, unauthorized access to someone else's account, hijacking their phone, or systematically recording private conversations can also lead to legal and criminal liability.

Employees should first contact the data controller to inquire about which of their data is being processed, to whom it is being transferred, the purpose of the transfer, and the legal basis for such processing. The answer given, or the lack thereof, can constitute important evidence in subsequent complaints and lawsuits.

14. Competent Court and Remedies

The competent court may vary depending on the parties to the dispute and the legal basis for it.

Claims for compensation arising from the employment relationship and the employer's duty to protect the employee are, as a rule, heard in labor courts. Article 417 of the Turkish Code of Obligations regulates the employer's obligation to protect the employee's personality and the compensation for damages resulting from the violation of personality rights according to the provisions on breach of contract.

General jurisdiction courts may only be used for claims based on tort and violation of personal rights against a third party or competing firm that shared information. However, unfair competition disputes between merchants are heard in commercial courts.

The competent court for compensation claims arising from Law No. 4054 should also be determined according to the status of the parties and the nature of the dispute.

Applications regarding criminal liability can be made to the Public Prosecutor's Office; regarding the Personal Data Protection Law, applications should first be made to the data controller, and then, if the conditions are met, to the Personal Data Protection Board; and regarding competition violations, applications can be made to the Competition Authority.

Conclusion

The legal liability of a person who shares information about an employee working with a competitor may arise in multiple legal areas, depending on the content and purpose of the shared information.

From the perspective of the person sharing the information;

• Personal administrative fines if they have a decisive impact on the competition violation
• Disciplinary liability due to violations of KVKK (Personal Data Protection Law) and company policies
• The employer's obligation to compensate for damages,
• Termination of the employment contract for just cause,
• Unfair competition liability,
• The crime of unlawfully disclosing personal data,
• Crime of disclosing trade secrets

It may come up on the agenda.

The employee whose information was shared may be entitled to compensation for material and moral damages due to the unlawful disclosure. However, compensation is not automatic. The unlawfulness, the damage, and the causal link between the disclosure and the damage must be demonstrated.

Depending on the circumstances, an employee may claim compensation from the data controller employer, the person who shared the information, and the competing firm that obtained the information unlawfully. If the sharing is part of an information exchange between competing employers coordinating wages, benefits, or hiring conditions, a claim for triple damages under Law No. 4054 on competition law may also arise, provided the conditions are met.

The Personal Data Protection Board does not award compensation. The Board handles the complaint and administrative sanction process; a separate lawsuit must be filed in the competent court to recover the employee's material and moral damages.