NEWSLETTER-2017

327 PERSONAL DATA PROTECTION Anonymization of Personal Data According to the Regulation, anonymization of personal data renders personal data useless to be associated with a specific or iden- tifiable real person in any way, even if the personal data is matched with other data. The data controller is obliged to take all necessary technical and administrative measures concerning the anonymization of personal data. Anonymization is the removal of the identity of the relevant per- son, by removing or changing all direct and / or indirect identifiers in a dataset, or the loss of the ability to be distinguished within a group or crowd, so that it cannot be associated with a real person. Any data that does not point to a particular person as a result of blocking or losing these properties is considered to be anonymous data. The goal of anonymizing is to break the link between the data and the person identified by that data. The methods of anonymizing are carried out by methods such as automatic or non-automatic group- ing, masking, derivation, generalization, and randomization applied to records in the data recording system. As a result of applying these methods, the obtained data must not be able to identify a specific per- son. There are many ways of anonymizing personal data. The data controller decides which of these methods to apply by taking into account the data at hand. With respect to the data set owned when applying anonymization methods, it is important to consider data characteristics, such as the nature of the data, its size, the structure of the physical environment, its diversity, and the purpose of processing the data. Storage and Destruction Policy of Personal Data Pursuant to Article 16 of Law No. 6698, the data controllers who are responsible for being registered with the Data Controllers Register are obliged to prepare a personal data storage and destruction policy in accordance with the personal data processing inventory. The data controller’s preparing a policy of personal data storage and destruction does not mean that personal data has been stored, deleted, removed or