NEWSLETTER-2020-metin

399 PERSONAL DATA PROTECTION • Right to be forgotten: Even though under the rights of the data subject, the KVKK regulates the right to obtain information about the personal data subject to processing from the data controller and to request deletion, the GDPR regulates the right to be forgotten in a more detailed way. Pursuant to Article 17 of the GDPR, the data controller shall have the obligation to erase the personal data without undue delay when; i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; ii) the data subject withdraws consent upon which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; iii) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); iv) the personal data have been unlawfully processed; v) the personal data have to be erased for compliance with a legal obligation in a Union or Member State law to which the controller is subject; vi) the personal data have been col- lected in relation to the Offer of Information Society Services referred to in Article 8(1). Territorial Scope Pursuant to Article 3 of the GDPR; 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a control - ler or a processor in the Union, regardless of whether or not the processing takes place in the Union. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union, by a controller or processor not established in the Union, where the processing activities are related to: