Guidelines on the Protection of Personal Data in Election Activities

On 24.01.2024, the Personal Data Protection Authority published the Guidelines on the Protection of Personal Data in Election Activities (Guidelines). The Guidelines aim to remind public administrations, political parties, candidates, and voters involved in election activities of their obligations or rights under Law No. 6098 on the Protection of Personal Data (Law or PDPL). The highlights of the Guidelines are briefly summarized below:

• The Guidelines state that the Supreme Election Council (SEC), political parties, and independent candidates are the data controllers in terms of data processing carried out within the scope of election activities.
• Pursuant to Art. 28 of the PDPL, it is considered that the articles regulating the obligation to inform data subjects, the rights of data subjects (except for the right to claim damages) and the obligation to register in the register of data controllers do not apply to SEC, which is responsible for the management and supervision of elections. On the other hand, political parties and independent candidates are obliged to inform data subjects and allow them to exercise their rights during personal data processing activities.
• Information containing health data such as disability data may be transferred by SEC without seeking explicit consent due to the provision regulated in Article 8/3 of the PDPL stating that “Provisions in other laws regarding the transfer of personal data are reserved”. Article 6 of Law No. 7062, Article 36, and Article 74 of Law No. 298 are given as examples of such provisions in the Guidelines.
• The Guidelines state that political parties may process communication data to send audio, video or written messages to their members; however, they can’t conduct propaganda by sending messages to the e-mail addresses of citizens or by sending audio, video, or written messages to their phones.
• The Guidelines underline that independent candidates should not send audio, video, or text messages to citizens and should not process citizens' personal data for this purpose.