Information Note on Processing of Personal Data on the Legal Ground of Being Stipulated by Laws was Published

On 12.02.2024, the Information Note on Processing of Personal Data on the Legal Ground of Being Stipulated by Laws (Information Note) was published. The Information Note aims to clarify the scope and meaning of the personal data processing legal ground of “being expressly stipulated by law” in Article 5/2(a) of the Law on Personal Data Protection No. 6698 (LPDP). The significant points in the Information Note are briefly summarized below:

• The right to request the protection of personal data is regulated in Article 20 of the Constitution of the Republic of Türkiye and fundamental rights and freedoms can only be restricted by law.
• The Information Note first distinguishes between legislative and administrative regulation when determining the scope of the “being expressly stipulated by law” legal ground for personal data processing. Accordingly, personal data can be processed based on the relevant legal ground only if there is an explicit provision in any law or if this provision is referred to a secondary legislation. For example, employee identification data can be processed under Article 75 of Labor Law No. 4857 based on this legal ground. 
• The phrase “explicit” in the text of the Article should be interpreted broadly. For example, the processing of data such as bank account numbers and social insurance numbers of employees for the employer to pay the salaries falls within this scope. 
• The Information Note also discusses the application of the EU General Data Protection Regulation (GDPR). Unlike the LPDP, in the GDPR, the data processing legal ground of “being expressly stipulated by law” is not regulated separately; it is evaluated within the term “processing is necessary for compliance with a legal obligation”. 
• To rely on the "legal obligation" in terms of the application of the GDPR, the data controller must assess whether data processing is necessary to comply with the legal obligation and clearly point to the specific law, board, or court decision. It is also stated that primary and secondary legal regulations are accepted within the scope of this legal ground.