Turkey: The Data Subject Rights Vs. Rights Strictly Bound

Although the definition of the concept of rights strictly bound is not included in the Turkish Legislation, in the Turkish Civil Code ("TMK") numbered 4721¹, "rights strictly bound"² are mentioned in article 16 only in one time. The concept of a strict dependent right to person is, as a rule, an absolute right that cannot be used through representative. This right can be exercised only by the rightful owner, and it is not possible to alienate this right to third parties and pass it to their heirs. Although these rights, which are entitled to individual existence, are a subject that should be discussed very broadly, it should be discussed in terms of personal data.

The concept of personal data has a similar definition in the Personal Data Protection Law No. 6698³ ("KVKK") and the European Union General Data Protection Regulation⁴ ("GDPR"), and expresses any information of a specific or identifiable natural person. According to definition, personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected can lead to the identification of a particular person, also constitute personal data.⁵

In Article 11 of the KVKK, everyone has been given the right to request data about their personal data by applying to the data controller, as well as to the Personal Data Protection Board as a second step in cases where the data controller does not respond within time or if the answer is insufficient ("the Board ") has been granted the right to complain.

The important issue here is whether the right to request information about personal data and to complain to the Board is an absolute right. If these rights are deemed to be strictly dependent on the person, then the person concerned will not only be permitted to request information about personal data related to him and to be used by someone else by proxy. Although there is no clarity in this situation in KVKK and its justification, the Board has decided in which this issue has been passed. A complaint was made to the Board by applicant, who was the heir and spouse of the deceased, in the decision no. 2019/273 of 18.09.2019⁶. Upon requesting the health data of the deceased spouse, but rejecting this request, the applicant applied to the Authority, but it was decided by the Board that there was no action to be taken for this application. The important point in the decision is that it has been suggested that the personality definition should be made in accordance with Article 28 of the TMK and articles 3 and 11 of the KVKK ask for information about the personal data related to deceased, and that no information can be requested about the personal data for the deceased spouse.

With this decision, a debate may arise whether the right to demand personal data is strictly dependent on the individual. Although it is debatable with the lawfulness of the rejection of this request due to the fact that the person is dead in the decision, it should be possible to recognize the real persons' requests for information about personal data with a proxy relationship in accordance with the personality definition. Because even if there is a debate about the fact that personal data is personal rights in terms of the nature of the personal data, it is certain that the right to demand information about personal data is not strictly dependent on the person. In this context, the data subject will be able to exercise this right through another person by giving power of attorney if the data subject wishes to apply to the board.

Even though general attorneys of lawyers are thought to be able to apply on behalf of the person concerned, Article 10 of the Regulation on Personal Health Data⁷ published by the Ministry of Health is as follows:

It is understood that lawyers can request health data with a power of attorney even though there are discussions⁸ in accordance with the above article of this regulation. Health data are special personal data within the scope of KVKK and should be processed according to personal data and should be treated more precisely. If the principle of "there is little in the majority"⁹ is set out, it will be possible to request a proxy with personal power of attorney for personal data. From this, it can be concluded that the right to request personal data is not a strict right to the person.

Besides the right to protect personal data is a constitutional right, there are various opinions regarding its nature. Regardless of the nature of the right to protect personal data, regardless of the nature of the right to request personal data, it is not a strict right to a person. This right can be alienable to a third party or lawyer within the framework of the proxy by the data subject. If the right to request personal data is to be made available to a third party within the framework of the proxy relationship, then it will be possible to apply to the Board only via e-mail or cargo. Because, online application via KVK complaint module¹⁰ will only be possible through the e-government of the person, and it will not be possible to apply here by proxy. The Personal Data Protection Board also provided information on this subject and the implementation will continue in the future.

Consequently, the right to demand for personal data is not strictly dependent on the person, in accordance with the law and equity pursuant to the civil law, KVKK or the Board's information. There is no legal obstacle to the use of this right by third parties within the scope of the agency.

Footnotes