KVKK Announcement Regarding the Processing of Personal Data Belonging to Debtors’ Relatives by Creditors’ Attorneys

According to the public announcement published by the Personal Data Protection Authority (Authority), several complaints have been submitted indicating that creditors’ attorneys accessed the phone numbers of relatives of indebted individuals and shared the debt-related personal data of those individuals via phone calls or messages. These practices may constitute a breach of the Law on the Protection of Personal Data No. 6698 (LPPD) in terms of both the lawful processing of personal data and the obligations related to data security.

The key highlights of the Authority’s announcement are summarized below:

• In the absence of explicit consent or any lawful basis for data processing, using the contact details of an individual’s relatives to share debt-related information is considered unlawful under the LPPD.
• The processing of third-party personal data is only permissible under the conditions set forth in the LPPD, provided that the fundamental rights and freedoms of the data subjects are not violated.
• Data controllers are obliged to take all necessary technical and administrative measures to prevent unlawful access to and processing of personal data.
• In case of a violation of the LPDD, administrative fines may be imposed on data controllers depending on the nature of the infringement.

The Authority emphasizes that during debt collection processes, the personal data of both the debtor and any unrelated third parties must be processed in full compliance with the LPPD.

The Authority’s Public Announcement