SUMMARIES OF THE DECISIONS OF THE TURKISH DATA PROTECTION BOARD

       A. INTRODUCTION

The new decision summaries published by the Turkish Data Protection Authority (the “Authority”) on its official website on 10 August 2026 contain significant assessments concerning the conditions for processing personal data, the obligation to inform, explicit consent, data subject rights, video and audio surveillance practices in workplaces, cookies, commercial communication activities, special categories of personal data, and the safeguarding of personal data.

The 47 decision summaries published by the Authority illustrate, through specific cases, various personal data processing activities and data security risks that data controllers operating in different sectors may encounter.

In particular, the decisions demonstrate that the mere existence of a valid condition for processing personal data is not sufficient; processing activities must also be conducted in accordance with the general principles stipulated under the Law, in a proportionate manner, and consistently with the reasonable expectations of data subjects.

Accordingly, this bulletin briefly examines each of the decision summaries of the Turkish Data Protection Board (the “Board”) in terms of the subject matter of the decision, the Board’s principal assessments, and the practical implications arising from the outcome. The purpose is to provide a consolidated overview of the approaches that have recently come to the fore in the Board’s practice and the principal compliance matters requiring attention by data controllers.

 

1. Board Decision on Unsolicited SMS Messages and Telephone Calls for Advertising and Marketing Purposes

The summary of the Board’s decision dated 10 June 2026 and numbered 2026/1183 has been published.

A complaint was filed with the Authority alleging that, within the scope of a “brand ambassador” programme operated by a data controller active in the savings finance sector, customers were asked to provide the contact numbers of third parties; that the data subject’s telephone number was transferred to the data controller in this manner and used to send advertising and marketing SMS messages and make telephone calls; and that this processing was carried out without obtaining the data subject’s explicit consent.

In its assessment, the Board concluded that:

• Where personal data are not obtained from the data subject and will be used for communication purposes, the obligation to inform must be fulfilled at the time of the first communication;
• In the circumstances of the case, the data subject’s conduct in continuing the conversation concerning the campaign could not be regarded as valid explicit consent under the Law;
• Valid explicit consent must be given in relation to a specific subject, based on adequate information, and expressed freely; and
• The processing activities carried out within the scope of the “brand ambassador” programme without any applicable condition for processing personal data were contrary to the Law.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 1,000,000 on the data controller for processing the data subject’s personal data without any valid condition for processing stipulated under Article 5 of Law No. 6698 on the Protection of Personal Data (the “Law”).

Key legal assessment: A person’s continuation of a marketing conversation or expression of interest in a campaign does not constitute valid explicit consent under the Law.

You can access the full text of the decision here.

 

2. Board Decision on Personal Data Processing Activities Conducted in a Penitentiary Institution

The summary of the Board’s decision dated 19 December 2024 and numbered 2024/2158 has been published.

A data subject held in a closed penitentiary institution applied to the Authority, stating that personal data such as their first name, surname, Turkish identity number, prison registration number, conviction status, and date of admission to the prison were displayed openly on collection and disbursement receipts and could be viewed by the personnel on duty.

In its assessment, the Board concluded that:

• The provisions of the Law do not apply where personal data are processed by judicial or enforcement authorities in relation to investigations, prosecutions, judicial proceedings, or the execution of criminal penalties and security measures; and
• The recording of funds belonging to convicted prisoners and detainees and the issuance of collection and disbursement receipts are expressly regulated under the relevant legislation.

Following its examination, the Board decided:

• That the processing of personal data appearing on collection and disbursement receipts fell within the exemption set out in Article 28(1)(d) of the Law and, accordingly, that no action could be taken under the Law, as its provisions were inapplicable.

Key legal assessment: Under Article 28(1)(d) of the Law, personal data processing activities carried out by enforcement authorities in connection with the execution of criminal penalties and security measures may fall outside the scope of the Law.

You can access the full text of the decision here.

 

3. Board Decision on Making In-Flight Internet Service Conditional upon Explicit Consent

The summary of the Board’s decision dated 15 August 2024 and numbered 2024/1393 has been published.

A complaint was filed with the Authority alleging that, to use the internet service offered during a flight, the data subject was required to select a checkbox on the portal authorising the sharing of personal data for verification purposes, and that explicit consent was requested even though the processing could have been based on conditions for processing other than explicit consent.

In its assessment, the Board concluded that:

• Verification of the data subject’s surname, seat number, or ticket number through the airline’s systems was necessary for providing the internet service;
• The processing activity in question could be carried out on the basis of conditions for processing other than explicit consent; and
• Nevertheless, requesting the data subject’s explicit consent was misleading and misdirecting and therefore contrary to the principle of lawfulness and fairness.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 90,000 on the data controller, an internet service provider, for requesting the data subject’s explicit consent despite the availability of conditions for processing other than explicit consent.

Key legal assessment: Where a personal data processing activity may be based on a legal ground other than explicit consent, requesting explicit consent in addition may result in the data subject being misled or misdirected.

You can access the full text of the decision here.

 

4. Board Decision on Security Cameras, Cookies, and Explicit Consent for Marketing Purposes

The summary of the Board’s decision dated 8 August 2024 and numbered 2024/1361 has been published.

The Board examined the data controller’s practices concerning video and audio recording through security cameras, the use of cookies, and explicit consent processes for the processing of personal data for marketing purposes.

In its assessment, the Board concluded that:

• Video recording through cameras for security purposes may constitute lawful processing where it is necessary and proportionate in the circumstances of the specific case;
• Audio recording through camera systems must be assessed separately in terms of necessity and proportionality where video recording alone is sufficient for security purposes;
• For non-essential cookies, explicit consent must be obtained through an opt-in mechanism that enables the data subject to provide prior and unambiguous consent;
• Explicit consent to the processing of personal data for marketing purposes must not be made a mandatory component of the service provided to the data subject and must be freely given; and
• The obligation to inform and the explicit consent processes must be conducted separately.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 250,000 for violations relating to non-essential cookies and explicit consent processes and a further TRY 15,000 for failure to fulfil the obligation to inform, amounting to a total administrative fine of TRY 265,000;
• To instruct the data controller to bring its information, cookie, and explicit consent processes into compliance with the Law and to refrain from making explicit consent for advertising and marketing purposes a prerequisite for receiving the service; and
• To take no further action regarding video recording through security cameras.

Key legal assessment: In the circumstances of the case, the Board’s finding that the explicit consent mechanism for non-essential cookies must be structured as an opt-in mechanism based on the data subject’s prior and active declaration of intent also demonstrates that necessity, proportionality, and freely given consent must be assessed together in relation to video and audio surveillance and the processing of personal data for marketing purposes.

You can access the full text of the decision here.

 

5. Board Decision on the Processing of Bank Account Information by an Insurance Company

The summary of the Board’s decision dated 8 August 2024 and numbered 2024/1359 has been published.

A complaint was filed with the Authority alleging that compensation for the diminution in value of a vehicle following a traffic accident was paid into the data subject’s personal bank account even though the data subject had not shared their bank account details with the data controller insurance company, and that the company had obtained those details without explicit consent.

In its assessment, the Board concluded that:

• The data subject’s IBAN was provided to the data controller by the policyholder of the other vehicle involved in the accident when the claim was notified, and the obtaining of this information was lawful under the relevant insurance legislation;
• The use of the IBAN for payment purposes in connection with a claim for diminution in value arising from the same accident was based on the condition that “processing is necessary for the establishment, exercise, or protection of a right”; and
• The data controller responded late to the data subject’s application because of a disruption in its internal processes.

Following its examination, the Board decided:

• That no action was required under the Law in respect of obtaining the data subject’s bank account information and using it to pay compensation for the diminution in value.

Key legal assessment: The fact that personal data were not obtained directly from the data subject does not, in itself, render the processing unlawful; whether a valid condition for processing exists in the circumstances of the particular case must be assessed separately.

You can access the full text of the decision here.

6. Board Decision on the Processing of a Mobile Telephone Number by Sending SMS Messages

The summary of the Board’s decision dated 8 August 2024 and numbered 2024/1350 has been published.

A complaint was filed with the Authority alleging that the data controller sent advertising and marketing SMS messages at frequent intervals and, on certain days, in rapid succession; that it continued sending messages even though the offers had been rejected during call-centre conversations; and that consent to commercial electronic communications had been obtained through a passive method.

In its assessment, the Board concluded that:

• The data controller was entitled to process the data subject’s mobile telephone number;
• Nevertheless, sending more than 20 SMS messages over a period of approximately three months for the purpose of providing information concerning the termination of the agreement exceeded the data subject’s reasonable expectations, constituted an abuse of rights, and was contrary to the principle of lawfulness and fairness; and
• Including the explicit consent text within the agreement could mislead data subjects and impair the elements of explicit consent; accordingly, it would be appropriate to present the explicit consent text separately from the agreement.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 100,000 on the data controller for sending SMS messages with the same content to the data subject at frequent intervals; and
• To remind the data controller that the explicit consent text should be presented separately from the agreement.

Key legal assessment: The existence of a valid legal ground for a processing activity does not grant a data controller an unlimited right to send communications; the frequency of communications must also be assessed under the principles of fairness and proportionality.

You can access the full text of the decision here.

 

7. Board Decision on the Rejection of a Request for Access to Telephone Call Recordings

The summary of the Board’s decision dated 18 April 2024 and numbered 2024/592 has been published.

An employee of the data controller bank filed a complaint with the Authority, stating that a customer had insulted them during a recorded telephone call; that they had requested a copy of the recording in order to pursue legal remedies; and that the bank had rejected the request on the ground that the recording contained information constituting customer secrets.

In its assessment, the Board concluded that:

• The right to request information set out in Article 11 of the Law also encompasses the right of access to personal data;
• The data subject had a legal interest in accessing the telephone call recording in order to pursue legal remedies; and
• The presence of information constituting a third party’s customer secrets in the call did not entirely extinguish the right of access, since the recording could be provided to the data subject after such information had been redacted.

Following its examination, the Board decided:

• To instruct the data controller to provide the telephone call recording to the data subject as a written transcript or in digital format, after redacting the third party’s banking transaction data constituting customer secrets; and
• To remind the data controller that data subject applications under the Law must be handled effectively, lawfully, fairly, and with reasons provided.

Key legal assessment: The presence of confidential information belonging to third parties in a record does not extinguish the data subject’s right of access to their own personal data; where necessary, access must be provided after redacting the third parties’ data.

You can access the full text of the decision here.

 

8. Board Decision on the Processing of Personal Data through Video Surveillance in the Workplace

The summary of the Board’s decision dated 28 March 2024 and numbered 2024/540 has been published.

A complaint was filed with the Authority alleging that an area at the data subject’s workplace, which the data subject described as a changing room, was monitored by security cameras; that the data subject’s explicit consent had not been obtained; and that the data subject had not been adequately informed.

In its assessment, the Board concluded that:

• The cameras had been installed to protect employees’ personal belongings and prevent the recurrence of previous theft incidents and, accordingly, the video recording could be based on the data controller’s legitimate interest;
• Since the video recordings were retained for 60 days and subsequently destroyed, the processing activity was not contrary to the general principles set out in Article 4 of the Law;
• It was insufficient for the privacy notice to identify the conditions for processing merely through general references to provisions of the Law, and the specific legal ground must be expressly stated;
• The obligation to inform and the obtaining of explicit consent must not be carried out together; these processes must be conducted separately; and
• In applications submitted by an attorney on behalf of a data subject, no specific authority in the power of attorney could be required in the absence of an express legislative provision to that effect.

Following its examination, the Board decided:

• That no action was required under the Law in relation to video recording through cameras and the destruction of the recordings after 60 days;
• To instruct the data controller to revise the privacy notice in accordance with the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, and to separate the explicit consent and information processes; and
• To warn the data controller that no specific authority should be required in powers of attorney for data subject applications submitted through an attorney.

Key legal assessment: The use of cameras for security purposes in the workplace may be based on the legal ground of legitimate interest where it is necessary and proportionate; however, the specific legal ground for the processing must be expressly stated in the privacy notice, and the explicit consent process must be separated from the obligation to inform.

You can access the full text of the decision here.

 

9. Board Decision on a Request to Remove Information Concerning a Discharged Debt from a Risk Report

The summary of the Board’s decision dated 14 March 2024 and numbered 2024/444 has been published.

A complaint was filed with the Authority stating that information concerning a debt that had previously been paid and discharged continued to appear in the Findeks Risk Report and that the request to erase such data had been rejected by Kredi Kayıt Bürosu A.Ş.

In its assessment, the Board concluded that:

• Kredi Kayıt Bürosu A.Ş. is the data controller in relation to the Findeks Risk Report, and the compilation of information transferred by banks and financial institutions constitutes personal data processing;
• The Risk Centre processes personal data on the legal ground that processing is expressly provided for by law under Article 5 of the Law;
• Information concerning a discharged debt may continue to be processed and shared for ten years from the date on which the debt was discharged; and
• The processing period for the data subject’s debt, which was discharged in 2017, had not yet expired and the data would continue to be processed until 2027.

Following its examination, the Board decided:

• no action was required under the Law, since the processing period applicable to the data concerning the discharged debt had not yet expired

Key legal assessment: The payment and discharge of a debt does not require the immediate erasure of the related financial data; such data may continue to be processed in accordance with the applicable legislation and retention period.

You can access the full text of the decision here.

 

10. Board Decision on the Processing of Personal Data by Kredi Kayıt Bürosu

The summary of the Board’s decision dated 22 February 2024 and numbered 2024/292 has been published.

A complaint was filed with the Authority alleging that the data subject’s personal data had been unlawfully processed, retained, shared with third parties, and used for commercial purposes, and that the request for erasure had been rejected.

In its assessment, the Board concluded that:

• Kredi Kayıt Bürosu A.Ş. facilitates data sharing among banks and financial institutions under Banking Law and the Bank Cards and Credit Cards Law; accordingly, such processing may be carried out without explicit consent;
• The data subject’s Findeks membership remained active, and the personal data provided under the membership would be retained for ten years following termination of the membership and destroyed at the end of that period; and
• The response provided to the data subject by the data controller was clear and sufficient.

Following its examination, the Board decided:

• no action was required under the Law, since the data controller’s processing and retention activities were based on the applicable legislation and its response to the data subject was sufficient

Key legal assessment: Data-sharing and retention activities expressly provided for under banking and financial legislation may be carried out without explicit consent on the legal ground that processing is expressly provided for by law under Article 5 of the Law.

You can access the full text of the decision here.

 

11. Board Decision on the Processing and Transfer of Employee Personal Data and the Obligation to Inform

The summary of the Board’s decision dated 22 February 2024 and numbered 2024/284 has been published.

An employee of a subsidiary of a public entity filed a complaint with the Authority alleging that, after termination of the employment relationship, their personal data had been unlawfully processed, used for purposes incompatible with those for which they were collected, and transferred to third parties, and that the employee privacy notice was unlawful.

In its assessment, the Board concluded that:

• Employee data and corporate email content capable of serving as evidence in employment disputes may be retained where processing is necessary for the establishment, exercise, or protection of a right;
• Employees’ medical leave reports may be processed within the scope of the employer’s legal obligations, but access to health data must be limited to persons who require access by virtue of their duties;
• Deactivating a former employee’s account in the Personnel Management System does not mean that the personal data have been erased, and a request for access to data that continue to be retained must be fulfilled; and
• The employee privacy notice was deficient because it did not provide sufficient information on the monitoring and retention of corporate email content.

Following its examination, the Board decided:

• To instruct the data controller to fulfil the data subject’s access request and update the privacy notice in accordance with the Law;
• To remind the data controller that access to health data must be restricted to relevant personnel and that data subject applications must be answered clearly, intelligibly, and with reasons; and
• To take no further action concerning the retention of employee data and corporate email content for the exercise of defence rights in legal disputes or the processing of medical leave reports.

Key legal assessment: Deactivation of a former employee’s account does not amount to erasure of personal data; access requests concerning personal data that continue to be retained must be fulfilled.

You can access the full text of the decision here.

 

12. Board Decision on Explicit Consent and the Processing of Identity Information in a Subscription Agreement

The summary of the Board’s decision dated 22 February 2024 and numbered 2024/282 has been published.

A complaint was filed with the Authority stating that an internet subscription had been terminated due to the absence of an identity document and that requests for the destruction of personal data and disclosure of the third parties to whom the data had been transferred were not fulfilled. The Board also initiated an ex officio examination after identifying provisions in the subscription agreement concerning explicit consent and transfers to group companies.

In its assessment, the Board concluded that:

• Requesting an identity document to establish a new subscription agreement was lawful because it was necessary for entering into the agreement and for the data controller to comply with its legal obligations;
• The identity information could continue to be retained to exercise defence rights in legal disputes and comply with statutory obligations; and
• Obtaining explicit consent in the subscription agreement when another valid condition for processing was available was misleading and contrary to the principle of lawfulness and fairness.

Following its examination, the Board decided:

• To take no further action regarding the obtaining and retention of identity information;
• To impose an administrative fine of TRY 350,000 for including provisions amounting to explicit consent in the subscription agreement;
• To provide the data subject with a copy of the subscription agreement and a list of the group companies to which their personal data had been transferred; and
• To instruct the data controller to remove statements amounting to explicit consent from the agreement and separate the explicit consent process from both the agreement and the privacy notice.

Key legal assessment: Obtaining explicit consent where another valid condition for processing exists may mislead the data subject and therefore contravene the principle of lawfulness and fairness.

You can access the full text of the decision here.

 

13. Board Decision on the Sharing of Employee Data Due to an Incorrect Integration

The summary of the Board’s decision dated 22 May 2025 and numbered 2025/881 has been published.

The data controller, which develops telecommunications technologies, notified the Authority that an employee had inadvertently enabled the integration of a different application within an application used to monitor business travel and expenses, resulting in certain employees’ personal data being shared with a third-party company. The breach affected 488 individuals and involved first names, surnames, business email addresses, and business telephone numbers.

In its assessment, the Board noted that:

• The breach resulted from an inadvertent action by an employee;
• It was detected after employees received automated emails, whereupon the integration was immediately disabled and deletion of the shared data was requested; and
• The relevant employees had received personal data protection training within the preceding year, and the likelihood of adverse consequences for the data subjects was low.

Following its examination, the Board decided:

• Having regard to having regard to the nature of the breach, the measures taken, and the level of risk to data subjects, no action was required at that stage under Article 12 of the Law

Key legal assessment: Not every personal data breach results in an administrative sanction; the Board assesses the scope of the breach, the risk to data subjects, and the measures taken by the data controller both before and after the breach.

You can access the full text of the decision here.

 

14. Board Decision on a Personal Data Breach Caused by Unauthorised Access to a Newsletter Platform

The summary of the Board’s decision dated 2 May 2025 and numbered 2025/833 has been published.

The Authority was notified that unauthorised access to the newsletter distribution platform of a non-profit data controller supporting scientific advancement had resulted in a personal data breach affecting 15 individuals residing in Türkiye. The affected data comprised first names, surnames, and email addresses.

In its assessment, the Board found that:

• The platform was temporarily shut down and the data subjects were notified after the breach was detected;

• There was no indication that the compromised data had been used for fraud or identity theft, and the risk to data subjects was extremely low; and

• Additional security measures, including multi-factor authentication, were being considered to prevent similar breaches.

Following its examination, the Board decided:

• That no action was required at that stage under Article 12 of the Law, having regard to the scope and risk level of the breach and the measures taken; and
• To remind the data controller that the Personal Data Breach Notification Form must be used for notifications to the Board in accordance with Board Decision No. 2019/10.

Key legal assessment: When determining whether a personal data breach warrants a sanction, the scope of the breach, the risk to data subjects, and the measures taken by the data controller are considered together.

You can access the full text of the decision here.

 

15. Board Decision on the Breach Notification Obligation of a Data Controller Established Abroad

The summary of the Board’s decision dated 28 March 2025 and numbered 2025/601 has been published.

The Authority was notified that unauthorised access to the systems of a Hong Kong-based data controller operating in the hotel and accommodation sector may have affected various personal data, including identity, contact, and payment information, belonging to 909 persons residing in Türkiye.

In its assessment, the Board concluded that:

• The Law contains no express provision on its territorial scope;
• Under Board Decision No. 2019/10, the effects doctrine applies to breaches occurring abroad;
• In determining whether a foreign data controller is subject to the breach notification obligation, it must be considered whether the data subjects benefited from the relevant products or services in Türkiye; and
• In the circumstances, the data subjects did not benefit from the services in Türkiye and the data controller had no establishment, employees, or technological infrastructure in Türkiye.

Following its examination, the Board decided:

• no action was required under the Law, as the particular processing activity fell outside the territorial scope of the Law and the data controller was not subject to a breach notification obligation

Key legal assessment: The effects doctrine is applied in determining the applicability of the Law to foreign data controllers; whether data subjects benefit from the relevant products or services in Türkiye is significant.

You can access the full text of the decision here.

 

16. Board Decision on a Personal Data Breach Caused by Sending Email Addresses Without Concealing Them

The summary of the Board’s decision dated 12 March 2025 and numbered 2025/536 has been published.

A data controller manufacturing and selling small household appliances notified the Authority that recipients’ email addresses had not been concealed in 14 informational emails sent to customers, allowing the addresses to be viewed by third parties. The breach was estimated to affect 500 customers and involved email addresses only.

In its assessment, the Board noted that:

• The employee noticed the breach immediately after the emails were sent and took action to recall them
• Only email addresses were affected
• The likelihood of adverse consequences for data subjects was low

Following its examination, the Board decided:

• Having regard to in view of the nature of the breach, the affected data category, and the level of risk to data subjects, no action was required at that stage under Article 12 of the Law

Key legal assessment: Disclosing recipients’ email addresses may constitute a personal data breach; however, the limited nature of the incident and its low risk level are taken into consideration when assessing sanctions.

You can access the full text of the decision here.

 

17. Board Decision on Unauthorised Access to Customer Data through Malware

The summary of the Board’s decision dated 9 January 2025 and numbered 2025/88 has been published.

The Authority was notified that a computer belonging to an IT employee of a data controller operating a restaurant chain in the quick-service food sector had been accessed through malware. Usernames and passwords saved in the browser were compromised, enabling access to company systems and affecting the first names, surnames, gender, email addresses, telephone numbers, and city information of 505,337 customers.

In its assessment, the Board concluded that:

• Storing usernames and passwords in a browser, the absence of alert systems for unauthorised access, and the implementation of measures such as two-factor authentication only after the breach demonstrated inadequate technical safeguards;
• The data controller could not provide information or documentation showing that employees had received sufficient data security training before the breach.

Following its examination, the Board decided:

• An administrative fine of TRY 800,000 for failure to take the necessary technical and organisational measures; and
• An administrative fine of TRY 200,000 for failure to notify the data subjects of the breach without undue delay, amounting to a total fine of TRY 1,000,000.

Key legal assessment: Saving user credentials in browsers, failing to implement two-factor authentication and monitoring or alert systems, and deficiencies in employee training may be regarded as inadequate data security measures under Article 12 of the Law.

You can access the full text of the decision here.

 

18. Board Decision on a Personal Data Breach Resulting from a Ransomware Attack

The summary of the Board’s decision dated 26 December 2024 and numbered 2024/2196 has been published.

The Authority was notified that a ransomware attack against the systems of a data controller manufacturing plastic household goods and cleaning products had encrypted company data and led to a ransom demand, and that employee and customer data might have been affected.

In its assessment, the Board concluded that:

• The data controller made inconsistent statements concerning the affected persons, data categories, and date of detection and failed to submit certain requested information and documents to the Authority;
• Adequate encryption measures for special categories of personal data had not been implemented before the breach, log records were unavailable, and security vulnerability testing was insufficient; and
• Two-factor authentication was enabled only after the breach, and network segmentation among group companies was inadequate.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 250,000 for failure to take the necessary technical and organisational measures to safeguard personal data

Key legal assessment: Inconsistent breach statements, inadequate logging, insufficient encryption, weak network segmentation, and the absence of two-factor authentication may be regarded as inadequate data security measures under Article 12 of the Law.

You can access the full text of the decision here.

 

19. Board Decision on a Personal Data Breach Caused by Unauthorised Access to an FTP Server

The summary of the Board’s decision dated 7 November 2024 and numbered 2024/1899 has been published.

The Authority was notified that a user account employed for marketing purposes by a data controller providing corporate support services to European group companies had been compromised, resulting in unauthorised access to folders on an FTP server and affecting the first names, surnames, email addresses, contact details, and addresses of approximately 70,000 individuals.

In its assessment, the Board concluded that:

• the delayed detection indicated inadequate monitoring of unauthorised access
• leaving folders containing personal data “publicly accessible” enabled the access
• the introduction of strong password policies only after the breach showed that pre-breach safeguards were insufficient

Following its examination, the Board decided:

• To impose an administrative fine of TRY 700,000 for failure to take the necessary technical and organisational measures

Key legal assessment: Failure to restrict access privileges, making files containing personal data publicly accessible, and weak password policies constitute breaches of the data security obligation.

You can access the full text of the decision here.

 

20. Board Decision on Unauthorised Access to Servers through Ransomware

The summary of the Board’s decision dated 7 November 2024 and numbered 2024/1898 has been published.

The Authority was notified that a server belonging to a data controller operating in the pharmaceutical and healthcare products sector had been encrypted by ransomware, affecting the identity, contact, personnel, and customer transaction data of 520 individuals.

In its assessment, the Board concluded that:

• The attacker’s ability to perform multiple stages of activity on the server, including downloading malware, executing files, and running code, demonstrated deficiencies in monitoring personal data security;
• The numerous recommendations in the post-incident report concerning network, server, user security, testing, and auditing indicated that pre-breach measures were inadequate; and
• Sufficient security and monitoring mechanisms were absent for remote access and log records.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 350,000 for failure to take the necessary technical and organisational measures

Key legal assessment: Basic security tools alone are insufficient against cyberattacks; systems must be actively monitored and logged, kept up to date, and regularly tested for vulnerabilities.

You can access the full text of the decision here.

 

21. Board Decision on Unauthorised Access to Personal Data Resulting from a Trojan Attack

The summary of the Board’s decision dated 9 October 2024 and numbered 2024/1718 has been published.

The Authority was notified that a Trojan had infected one of the network servers of a data controller operating in the cosmetics and personal care sector, resulting in unauthorised access to personal data and a ransom demand. The breach affected the identity and contact information of approximately 432 individuals in Türkiye.

In its assessment, the Board concluded that:

• the deployment of an endpoint detection and response solution only after the breach demonstrated inadequate pre-breach safeguards
• sufficient risk analysis had not been undertaken to identify potential risks and plan mitigating measures
• adequate penetration testing and security scans had not been performed before the breach

Following its examination, the Board decided:

• To impose an administrative fine of TRY 500,000 for failure to take the measures necessary to safeguard personal data

Key legal assessment: Effective endpoint security, regular risk analysis, vulnerability scanning, and penetration testing are among the fundamental elements of the data security obligation under Article 12 of the Law.

You can access the full text of the decision here.

 

22. Board Decision on a Breach of Employee Data Resulting from a Phishing Attack

The summary of the Board’s decision dated 10 September 2024 and numbered 2024/1523 has been published.

The Authority was notified that an employee of a data controller operating in the tourism and hospitality sector clicked a link in a phishing email, enabling third parties to control the computer and affecting a shift file containing the first names and surnames of 450 employees.

In its assessment, the Board concluded that:

• The use of systems with deficient updates and configurations, including outdated software and systems;
• Weak passwords and inadequate protection against spam emails; and
• The absence of an authentication mechanism for access to server rooms, which also constituted a physical-security deficiency.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 500,000 for failure to take the necessary technical and organisational measures

Key legal assessment: In phishing-related breaches, the Board considers not only employee error but also the data controller’s overall safeguards, including updates, password security, spam protection, employee awareness, and physical access controls.

You can access the full text of the decision here.

 

23. Board Decision on a Personal Data Breach Resulting from a Cyberattack on a Digital Gaming Platform

The summary of the Board’s decision dated 8 June 2023 and numbered 2023/1017 has been published.

The Authority was notified that a cyberattack against a data controller providing digital gaming and entertainment platforms affected the usernames, names, email addresses, dates of birth, gender, country, IP addresses, and website usage information of 90,182 residents of Türkiye, and that the attacker offered the obtained data for sale.

In its assessment, the Board concluded that:

• the breach was detected through the attacker’s forum post rather than the data controller’s security systems
• the data controller had not conducted penetration testing or maintained adequate logging and security monitoring
• the same vulnerability had been exploited twice, while the patch management policy was introduced only after the breach

Following its examination, the Board decided:

• To impose an administrative fine of TRY 1,500,000 for failure to take the measures necessary to safeguard personal data

Key legal assessment: The absence of regular logging, penetration testing, vulnerability scanning, and patch management constitutes a breach of the data security obligation under Article 12 of the Law.

You can access the full text of the decision here.

 

24. Board Decision on Unauthorised Access to a Mobile Application Database

The summary of the Board’s decision dated 16 May 2024 and numbered 2024/790 has been published.

The Authority was notified of unauthorised access to the database of a mobile application belonging to a data controller operating in the software and technology sector. The application contained 7,823 member records, and first names, surnames, email addresses, and telephone numbers in the database were accessed.

In its assessment, the Board concluded that:

• unauthorised persons had obtained the database password and that the post-breach change to the password policy demonstrated inadequate prior password security
• the absence of sufficient database logs prevented the precise cause of the breach from being determined
• a breach may arise from a loss of confidentiality or availability, not only from compromised data integrity

Following its examination, the Board decided:

• To impose an administrative fine of TRY 250,000 for failure to take the necessary technical and organisational measures; and
• To impose an administrative fine of TRY 100,000 for failure to notify the data subjects of the breach, amounting to a total fine of TRY 350,000.

Key legal assessment: The absence of any alteration to data integrity does not preclude a personal data breach; a loss of confidentiality through unauthorised access also constitutes a breach.

You can access the full text of the decision here.

 

25. Board Decision on the Publication of Election Survey Results Without Sufficient Anonymisation

The summary of the Board’s decision dated 22 February 2024 and numbered 2024/275 has been published.

The Authority received a notice stating that a local media outlet had collected information on individuals’ identities and voting preferences in an election survey and published the results on its website with only partial masking.

In its assessment, the Board concluded that:

• individuals remained identifiable because names were only partially masked, only the last four digits of telephone numbers were concealed, and neighbourhood information appeared in certain records
• consequently, the masking was insufficient to constitute anonymisation
• political opinions are special categories of personal data, while the text sent to data subjects did not satisfy the requirements of valid explicit consent

Following its examination, the Board decided:

• To impose an administrative fine of TRY 40,179 for processing special categories of personal data without a legal basis

Key legal assessment: Partial masking is not regarded as anonymisation if an individual can still be identified when the information is combined with other data.

You can access the full text of the decision here.

 

26. Board Decision on a Personal Data Breach Caused by Sending an Invoice and Shipment to the Wrong Customer

The summary of the Board’s decision dated 9 May 2024 and numbered 2024/756 has been published.

The Authority was notified that, due to an error by packing personnel of a data controller retailing ready-to-wear clothing and textile products, a shipment and invoice belonging to one customer were sent to another. The breach affected one person’s first name, surname, address, telephone number, email address, and order information.

In its assessment, the Board noted that:

• The breach resulted from human error during the packing stage rather than a systemic security vulnerability;
• Only one person was affected by the breach, and the data subject was notified; and
• The risk of adverse consequences for the data subject was low.

Following its examination, the Board decided:

• Having regard to having regard to the nature and low risk level of the breach, no action was required at that stage under Article 12 of the Law

Key legal assessment: Not every breach caused by human error results in an administrative sanction; the scope of the breach and the level of risk to data subjects are also considered.

You can access the full text of the decision here.

 

27. Board Decision on Monitoring University Attendance through Fingerprints

The summary of the Board’s decision dated 8 February 2024 and numbered 2024/197 has been published.

Following a complaint that a university monitored student attendance through fingerprints and processed biometric data for this purpose, the Board initiated an ex officio examination.

In its assessment, the Board concluded that:

• fingerprint data constitute special categories of personal data
• the processing of fingerprints was contrary to the principle of proportionality
• Explicit consent alone does not render excessive processing lawful

Following its examination, the Board instructed the data controller:

• To cease processing biometric data immediately and monitor attendance through alternative methods;
• To destroy all fingerprint data processed to date; and
• To take disciplinary action against those responsible for implementing the necessary technical and organisational measures and inform the Board of the outcome.

Key legal assessment: Explicit consent does not render biometric data processing lawful where the processing is contrary to the principle of proportionality.

You can access the full text of the decision here.

 

28. Board Decision on the Erasure of a Newspaper Archive Article and the Right to Be Forgotten

The summary of the Board’s decision dated 28 December 2023 and numbered 2023/2185 has been published.

The data subjects requested the removal from the newspaper’s website and archive of an article published in 2001 that remained visible when searches were conducted using their names.

In its assessment, the Board concluded that:

• conflicts between freedom of the press and the right to the protection of personal data require a balancing exercise considering public interest, relevance, accuracy, and the balance between substance and form
• the processing in the article fell within the press-freedom exemption under Article 28 of the Law
• a request under the right to be forgotten to prevent the article from appearing in searches by name should first be directed to search engines

Following its examination, the Board decided:

• That no action was required under the Law regarding the request to erase the article from the newspaper archive;
• To inform the data subjects that requests concerning the right to be forgotten should first be submitted to search engines; and
• To remind the data controller that applications must be answered within the prescribed period and with reasons.

Key legal assessment: Erasure of content from a newspaper archive and delisting the association between the content and a person’s name in search-engine results are subject to different legal assessments.

You can access the full text of the decision here.

 

29. Board Decision on the Disclosure of Member Information Resulting from a Phishing Attack

The summary of the Board’s decision dated 9 May 2024 and numbered 2024/728 has been published.

The Authority was notified that an employee of an international professional organisation in finance and accounting received a fraudulent email appearing to come from the organisation’s President and CEO and sent the requested membership list to the attacker. The breach affected the first names, surnames, membership numbers, and, for certain members, email addresses of 217 Turkish members.

In its assessment, the Board concluded that:

• sharing the list without verifying the email indicated deficient employee awareness
• certain technical measures relating to email security and risk prevention were strengthened only after the breach
• employee training had not been sufficiently effective in creating data security awareness

Following its examination, the Board decided:

• To impose an administrative fine of TRY 750,000 for failure to take the necessary technical and organisational measures; and
• To impose an administrative fine of TRY 250,000 for failure to notify the Board within 72 hours, amounting to a total fine of TRY 1,000,000.

Key legal assessment: Merely providing employee training is not sufficient; training must be effective enough to create practical awareness of phishing and social-engineering risks.

You can access the full text of the decision here.

 

30. Board Decision on a Ransomware Attack Spreading from Servers Abroad to Systems in Türkiye

The summary of the Board’s decision dated 6 March 2024 and numbered 2024/415 has been published.

The Authority was notified that a LockBit ransomware attack against servers located in France belonging to a data controller in the automotive supply industry spread to servers in Türkiye, potentially affecting 43 persons and more than 100,000 records.

In its assessment, the Board concluded that:

• the spread to Turkish servers demonstrated inadequate access restrictions and network segmentation
• no penetration testing had been conducted before the breach and insufficient documentation was provided regarding regular security scans
• measures such as regular system controls, vulnerability scanning, penetration testing, and endpoint detection and response solutions should have been implemented

Following its examination, the Board decided:

• To impose an administrative fine of TRY 430,000 for failure to take the necessary technical and organisational measures

Key legal assessment: Where interconnected systems are used by group companies or across different locations, network segmentation and effective security monitoring must prevent malware from spreading throughout the network.

You can access the full text of the decision here.

31. Board Decision on the Exfiltration of Employee Data Resulting from a Ransomware Attack

The summary of the Board’s decision dated 6 March 2024 and numbered 2024/413 has been published.

The Authority was notified that a ransomware attack against systems of a foreign company affiliated with a data controller operating in agricultural machinery and equipment affected identity, contact, personnel, and certain health data of 56 employees in Türkiye, and that some of the data were exfiltrated.

In its assessment, the Board concluded that:

• the breach could have been prevented through multi-factor authentication, which was enabled only after the breach
• patches for known vulnerabilities were applied only afterwards
• the use of shared servers without adequate network segregation caused the breach to spread across multiple systems

Following its examination, the Board decided:

• To impose an administrative fine of TRY 150,000 for failure to take the measures necessary to safeguard personal data

Key legal assessment: Multi-factor authentication, current patch management, and network segregation are fundamental safeguards, particularly against ransomware attacks.

You can access the full text of the decision here.

 

32. Board Decision on a Personal Data Breach Caused by Security Deficiencies in an Administration Panel

The summary of the Board’s decision dated 25 January 2024 and numbered 2024/133 has been published.

The Authority was notified that a cyberattack against the database of a data controller providing online food ordering and delivery services resulted in data being erased and obtained by attackers, affecting the first names, surnames, telephone numbers, addresses, and email addresses of 1,362 users.

In its assessment, the Board concluded that:

• Saving the administration-panel password in a browser demonstrated a lack of due care regarding password security; and
• The absence of IP-based access restrictions in the database management software enabled unauthorised access and demonstrated that even basic, low-cost safeguards had not been implemented.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 250,000 for failure to take the necessary technical and organisational measures

Key legal assessment: Administration-panel passwords should not be stored in browsers, and database access should be restricted by IP address as part of basic data security safeguards.

You can access the full text of the decision here.

 

33. Board Decision on the Bulk Disclosure of Personal Data Due to Employee Error

The summary of the Board’s decision dated 28 September 2023 and numbered 2023/1675 has been published.

A personal data breach occurred when an employee using the human-resources application of a data controller manufacturing industrial kitchen equipment inadvertently selected bulk sending instead of individual sending, causing the first names, surnames, Turkish identity numbers, and addresses of 1,522 employees to be sent to 1,589 employees.

In its assessment, the Board concluded that:

• The breach resulted from the HR employee confusing menus with similar designs, and the error was understandable in the ordinary course of life; and
• Employees had received training on the Law and information security, and confidentiality and disciplinary arrangements were in place.

Following its examination, the Board decided:

• no action was required at that stage under Article 12 of the Law

Key legal assessment: In breaches caused by human error, the Board assesses together the prior training, access-security and organisational measures implemented by the data controller and the response to the incident.

You can access the full text of the decision here.

 

34. Board Decision on a Data Leak at a Hosting Company Caused by a Third-Party Software Vulnerability

The summary of the Board’s decision dated 21 March 2023 and numbered 2023/412 has been published.

The Authority was notified that a vulnerability in a customer-management panel used by a hosting company enabled unauthorised access and the transfer of data to an IP address abroad, affecting various data belonging to 31,179 individuals, including identity, contact, customer transaction, financial, and credit-card information.

In its assessment, the Board concluded that:

• detection approximately six months later indicated deficient personal data security monitoring
• mechanisms preventing bulk downloads, intrusion-detection systems, data masking, and data minimisation measures were inadequate
• the introduction of two-factor authentication and a strong password policy only after the breach indicated insufficient pre-breach safeguards

Following its examination, the Board decided:

• To impose an administrative fine of TRY 350,000 for failure to take the necessary technical and organisational measures

Key legal assessment: The use of third-party software does not eliminate the data controller’s security obligation; vulnerabilities must be monitored, bulk data exports restricted, and strong authentication measures implemented.

You can access the full text of the decision here.

 

35. Board Decision on a Personal Data Breach in Connection with Fraudulent Telephone Calls

The summary of the Board’s decision dated 28 December 2022 and numbered 2022/1407 has been published.

The Authority was notified that customers of a data controller operating in the fashion-textile sector were called by unidentified persons who demanded money on the pretext of undelivered parcels and that customer telephone numbers and purchase information might have been unlawfully obtained.

In its assessment, the Board concluded that:

• no leak originating from the data controller’s systems could be identified
• the data controller informed customers through its website and social-media accounts on the day it learned of the incident
• reasonable technical and organisational measures were in place, including penetration tests, multi-layer authentication, a breach-response plan, confidentiality undertakings, and data-security agreements

Following its examination, the Board decided:

• no action was required at that stage under Article 12(1) of the Law

Key legal assessment: The use of personal data in fraud does not, by itself, establish that the data leaked from the data controller’s systems; the source of the incident and the reasonable safeguards implemented must be assessed separately.

You can access the full text of the decision here.

 

36. Board Decision on a Personal Data Breach Resulting from a Global Ransomware Attack

The summary of the Board’s decision dated 23 December 2022 and numbered 2022/1375 has been published.

Ransomware infected the servers of an industrial company after an employee at its US establishment downloaded a program, and the attack spread globally to 797 servers. The personal data of 4,885 employees, customers, and suppliers in Türkiye were affected.

In its assessment, the Board concluded that:

• critical and urgent vulnerabilities identified in pre-breach penetration tests had not demonstrably been remedied
• simple passwords, storage of system passwords in files, inadequate access restrictions, and outdated operating systems created security vulnerabilities
• the employee’s installation of an internet-downloaded application demonstrated that information-security training had not been sufficiently effective

Following its examination, the Board decided:

• To impose an administrative fine of TRY 800,000 for failure to take the necessary technical and organisational measures; and
• To impose an administrative fine of TRY 200,000 for late notification of the personal data breach to the Authority, amounting to a total fine of TRY 1,000,000.

Key legal assessment: Conducting penetration testing is not sufficient by itself; identified vulnerabilities must be remedied in a timely manner and remediation must be documented.

You can access the full text of the decision here.

 

37. Board Decision on an Examination Following an Alleged Data Leak

The summary of the Board’s decision dated 7 October 2022 and numbered 2022/1087 has been published.

After receiving a threatening email alleging that unidentified persons had accessed personal data, a data controller operating in the technology sector notified the Authority and commissioned independent security firms to conduct analyses and penetration tests.

In its assessment, the Board concluded that:

• although the tests identified certain high-level security findings, no evidence of a personal data leak was found
• the sample data in the threatening email did not match personal data in the data controller’s systems
• independent forensic and penetration-testing reports contained no findings confirming a breach

Following its examination, the Board decided:

• no action was required at that stage under Article 12(1) of the Law

Key legal assessment: An allegation or threatening message does not, by itself, establish that a personal data breach occurred; technical examinations and digital-forensic findings are important in verifying the incident.

You can access the full text of the decision here.

 

38. Board Decision on a Personal Data Breach Resulting from the Compromise of an Email Account

The summary of the Board’s decision dated 21 July 2022 and numbered 2022/714 has been published.

The email account of a senior manager of a data controller trading agricultural commodities was compromised, and emails containing malicious links were sent to approximately 1,000 persons, exposing personal data belonging to customers, suppliers, and employees to unauthorised access.

In its assessment, the Board concluded that:

• the inability to determine the number of affected persons demonstrated inadequate control over personal data
• advanced authentication, data-loss prevention, and attack or anomaly-detection systems were introduced only after the breach
• security and log monitoring were insufficient because the incident was detected only after a customer notification and the attacker retained access for two to three days

Following its examination, the Board decided:

• To impose an administrative fine of TRY 200,000 for failure to take the necessary technical and organisational measures

Key legal assessment: Multi-factor authentication, an effective password policy, and regular access and log monitoring are fundamental safeguards for email-account security.

You can access the full text of the decision here.

 

39. Board Decision on a Ransomware Attack Resulting from the Compromise of a Service Provider Account

The summary of the Board’s decision dated 21 July 2022 and numbered 2022/711 has been published.

Unauthorised access to the systems of a data controller operating in automotive security and electronic systems was obtained through a service provider’s user account. A ransomware attack affected various personal data, including identity, contact, personnel, and health information, belonging to 660 individuals.

In its assessment, the Board concluded that:

• the data controller must ensure an adequate security level is also provided by its processors and is jointly responsible with the processor under Article 12 of the Law
• the compromise of a long-standing service-provider account and the attackers’ lateral movement within the systems demonstrated inadequate safeguards
• failure to detect anomalous activity until the data were encrypted indicated deficient security monitoring

Following its examination, the Board decided:

• To impose an administrative fine of TRY 500,000 for failure to take the necessary technical and organisational measures

Key legal assessment: Engaging a processor does not eliminate the data controller’s security obligation; the data controller may also be held responsible for the service provider’s level of security.

You can access the full text of the decision here.

 

40. Board Decision on the Display of Personal Data Due to a Technical Error in a Mobile Application

The summary of the Board’s decision dated 21 July 2022 and numbered 2022/707 has been published.

A technical error in the mobile application of a retail data controller enabled certain users to view other customers’ personal data on their own membership pages. The breach was confirmed to have affected 17 persons and could have affected up to 136 persons.

In its assessment, the Board noted that:

• the data were not disclosed to the public and the risk of misuse was low
• the breach was detected promptly, the system was shut down, the faulty configuration was corrected, the necessary system checks were performed, and the data subjects were notified

Following its examination, the Board decided:

• no action was required at that stage under Article 12 of the Law

Key legal assessment: In breaches resulting from technical errors, the Board assesses the scope and risk level of the breach, the time taken to detect it, and the effectiveness of the data controller’s response together.

You can access the full text of the decision here.

 

41. Board Decision on Audio Recording through Security Cameras in the Workplace

The summary of the Board’s decision dated 30 November 2023 and numbered 2023/2007 has been published.

A complaint was filed with the Authority stating that video and audio were recorded by a camera in the security booth at the data subject’s workplace, that the data subject had not been informed, and that the recordings were subsequently used in court proceedings.

In its assessment, the Board concluded that:

• Recording audio in addition to video was neither necessary nor proportionate where physical security could be achieved through video recording; and
• None of the legal grounds under Article 5 of the Law applied to the processing of audio data for security purposes.

Following its examination, the Board decided:

• To impose an administrative fine of TRY 125,000; and
• To instruct the data controller to destroy the unlawfully processed audio recordings and inform the Board of the outcome.

Key legal assessment: Where video recording is sufficient for security purposes, additional audio recording may fail to satisfy the requirements of necessity and proportionality.

You can access the full text of the decision here.

 

42. Board Decision on the Processing of Personal Data in Connection with Municipal Library Membership

The summary of the Board’s decision dated 2 November 2023 and numbered 2023/1863 has been published.

A complaint was filed with the Authority alleging that membership was mandatory to use a municipal library and that various personal data were requested without fulfilling the obligation to inform.

In its assessment, the Board concluded that:

• personal data were processed on the legal grounds of necessity for entering into or performing a contract and for the establishment, exercise, or protection of a right, rather than explicit consent
• access to the library service was not conditional upon explicit consent
• the obligation to inform was fulfilled verbally and, at the relevant time, through privacy notices available on the website and the e-Government portal

Following its examination, the Board decided:

• no action was required under the Law

Key legal assessment: Where personal data necessary for providing a service are processed on valid grounds other than explicit consent, the service cannot be regarded as conditional upon explicit consent.

You can access the full text of the decision here.

 

43. Board Decision on the Recording of Telephone Calls and the Obligation to Inform

The summary of the Board’s decision dated 26 October 2023 and numbered 2023/1818 has been published.

The Board examined the recording of telephone calls between a data controller providing alarm and monitoring-system services and the data subject, and the adequacy of the information provided regarding such recording.

In its assessment, the Board concluded that:

• call recordings may be based on the legal grounds of necessity for the establishment, exercise, or protection of a right and legitimate interest, for the purposes of proving the contractual relationship and potential disputes
• merely stating that “your calls are being recorded” does not contain the elements required by Article 10 of the Law
• where layered information is used, the data subject must be directed to the full privacy notice

Following its examination, the Board decided:

• To take no action regarding the recording of the calls; and
• To impose an administrative fine of TRY 15,000 for failure to fulfil the obligation to inform properly and to instruct the data controller to make the necessary changes to its information process.

Key legal assessment: Merely stating that a telephone call is being recorded does not fulfil the obligation to inform under the Law; the minimum elements set out in Article 10 of the Law must also be provided to the data subject.

You can access the full text of the decision here.

 

44. Board Decision on Making Customer Data Accessible to Third Parties on a Website

The summary of the Board’s decision dated 19 October 2023 and numbered 2023/1796 has been published.

A complaint was filed with the Authority stating that a technical problem on a clothing store’s website had made the data subject’s first name, surname, membership information, and contact details accessible to third parties.

In its assessment, the Board concluded that:

• the fact that the technical problem arose within a service obtained from a processor did not eliminate the data controller’s security obligation
• the data controller and processor were jointly responsible and the relevant obligations could not be transferred entirely to the processor by contract
• adequate detailed testing had not been carried out before deploying changes to the live environment

Following its examination, the Board decided:

• To impose an administrative fine of TRY 200,000 because the personal data had been made accessible to an unrestricted audience

Key legal assessment: A technical error originating from a processor does not eliminate the data controller’s responsibility; software and configuration changes must be thoroughly tested before deployment to a live environment.

You can access the full text of the decision here.

 

45. Board Decision on Sending a COVID-19 Test Result to an Outdated Telephone Number

The summary of the Board’s decision dated 19 October 2023 and numbered 2023/1787 has been published.

A complaint was filed with the Authority after the data subject’s COVID-19 test result was sent not to the current telephone number provided during testing, but to an old number recorded in the data controller’s system years earlier and belonging to the data subject’s uncle.

In its assessment, the Board concluded that:

• health data are special categories of personal data
• data controllers must take reasonable measures to ensure that personal data are accurate and, where necessary, kept up to date
• sending the result to the old number despite receipt of the current number contravened the principle of accuracy and, where necessary, keeping data up to date

Following its examination, the Board decided:

• To impose an administrative fine of TRY 30,000; and
• To instruct the data controller to update the data subject’s telephone number and remove and destroy the former number from its records.

Key legal assessment: Particularly where sensitive information such as health data is concerned, ensuring the accuracy and currency of contact information is an important element of data security.

You can access the full text of the decision here.

 

46. Board Decision on Making a Live Match Streaming Service Conditional upon Explicit Consent for Marketing Purposes

The summary of the Board’s decision dated 21 September 2023 and numbered 2023/1610 has been published.

A complaint was filed with the Authority alleging that users of an online legal sports-betting and gaming platform were required to consent to commercial electronic communications in order to access a live match streaming service, thereby making the service conditional upon explicit consent to the processing of personal data for marketing purposes.

In its assessment, the Board concluded that:

• making the live streaming service conditional upon explicit consent to processing for commercial communications undermined the requirement that explicit consent be freely given

Following its examination, the Board decided:

• To impose an administrative fine of TRY 250,000; and
• To instruct the data controller to cease making the live streaming service conditional upon explicit consent to processing for marketing purposes.

Key legal assessment: Making access to a service conditional upon consent to the processing of personal data for marketing purposes invalidates the requirement that explicit consent be freely given.

You can access the full text of the decision here.

 

47. Board Decision on the Rejection of a Request for Access to Personal Data in a Penitentiary Institution

The summary of the Board’s decision dated 20 October 2022 and numbered 2022/1152 has been published.

A data subject held in a penitentiary institution filed a complaint with the Authority alleging that requests to view, examine, and obtain copies of their electronic file were not fulfilled, that their personal data had been shared with third parties, and that a sealed envelope sent by the Authority had been opened by penitentiary personnel.

In its assessment, the Board concluded that:

• the Law does not apply where personal data are processed by enforcement authorities in connection with investigations, prosecutions, judicial proceedings, or the execution of criminal penalties and security measures
• no documents supporting the allegation of unlawful disclosure to third parties had been submitted
• acts such as accessing the file and opening the sealed envelope fell within enforcement procedures

Following its examination, the Board decided:

• the allegations could not be assessed under the Law because some had not been substantiated and the remainder fell within the exemption under Article 28(1)(d)

Key legal assessment: Under Article 28(1)(d) of the Law, personal data processing activities conducted by enforcement authorities in relation to enforcement proceedings are exempt from the provisions of the Law.

You can access the full text of the decision here.

 

 

1. General Assessment

When the decisions published by the Authority are considered as a whole, it is apparent that relying on an appropriate legal ground is not, by itself, sufficient for personal data processing. Data controllers must also conduct processing activities in accordance with the general principles under the Law, inform data subjects effectively and adequately, obtain explicit consent—where required—freely and in relation to a specific subject, and implement technical and organizational measures for personal data security that are commensurate with the specific risks involved.

In particular, the Board’s assessments concerning employee and customer data, video and audio recordings, biometric data, commercial communications, cookies, data subject applications, and personal data breaches provide valuable guidance for data controllers in regularly reviewing their existing practices. Accordingly, companies should periodically assess their personal data processing activities in terms of legal grounds, purpose, proportionality, the obligation to inform, explicit consent, retention, transfers, access authorizations, and data security, and should take the necessary compliance measures in light of the Board’s current practice.