PERSONAL DATA PROTECTION LAW
PERSONAL DATA PROTECTION LAW
Law Number : 6698
Accepted Date: 24/3/2016
Published in the R. Newspaper: Date: 7/4/2016
Issue : 29677 Published Code : Order : 5 Volume : 57
FIRST PART
Purpose, Scope and Definitions
Purpose ARTICLE 1- (1) The purpose of this Law is to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data, and to regulate the obligations of natural and legal persons who process personal data and the procedures and principles to be followed. Scope
ARTICLE 2- (1) The provisions of this Law shall apply to natural persons whose personal data are processed and to natural and legal persons who process this data fully or partially automatically or non-automatically provided that they are part of any data recording system. Definitions
ARTICLE 3- (1) In the implementation of this Law; a) Explicit consent: Consent related to a specific subject, based on information and expressed with free will, b) Anonymization: Making personal data unable to be associated with an identified or identifiable natural person under any circumstances, even by pairing it with other data, c) Chairman: Personal Data President of the Protection Agency, ç) Relevant person: The real person whose personal data is processed, d) Personal data: All kinds of information regarding an identified or identifiable natural person, e) Processing of personal data: Wholly or partially automatic or any data recording All kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making it available, classifying or preventing its use, provided that it is a part of the system, f) The Board: Personal Data Protection Board, g) Institution: Personal Data Protection Authority, ğ) Data processor: The natural or legal person who processes personal data on behalf of the data controller based on his authority, 12302 h) Data recording system: The recording system in which personal data is structured and processed according to certain criteria, ı) Data controller: Personal means the natural or legal person who determines the purposes and means of processing the data and is responsible for the establishment and management of the data recording system.
SECTION TWO Processing of Personal Data General principles
ARTICLE 4- (1) Personal data can only be processed in accordance with the procedures and principles stipulated in this Law and other laws. (2) The following principles must be complied with in the processing of personal data: a) Compliance with the law and honesty rules. b) Being accurate and up-to-date when necessary. c) Processing for specific, explicit and legitimate purposes. ç) Being connected, limited and restrained with the purpose for which they are processed. d) To be kept for the period required by the relevant legislation or for the purpose for which they are processed. Terms of processing personal data
ARTICLE 5- (1) Personal data cannot be processed without the explicit consent of the person concerned. (2) In the presence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the data subject: a) It is expressly stipulated in the laws. b) It is compulsory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally recognized. c) It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract. ç) It is mandatory for the data controller to fulfill its legal obligation. d) The person concerned has been made public by himself. e) Data processing is mandatory for the establishment, exercise or protection of a right. f) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Conditions for the processing of special categories of personal data
ARTICLE 6- (1) Data regarding the race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, disguise and dress, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures. biometric and genetic data are special quality personal data. (2) Processing of sensitive personal data without the explicit consent of the person concerned is prohibited. 12303 (3) Personal data other than health and sexual life listed in the first paragraph may be processed without seeking the explicit consent of the person concerned, in cases stipulated by the laws. Personal data related to health and sexual life are only for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing, by persons or authorized institutions and organizations under the obligation of secrecy without seeking the explicit consent of the person concerned. can be processed. (4) In the processing of sensitive personal data, it is also obligatory to take adequate measures determined by the Board. person