Digital transformation has simplified personal data collection but raised the risk of misuse. This article explores personal data protection legislation in court proceedings. Our article provides a comprehensive understanding of the intricate dynamics when personal data is a focal point in legal proceedings, emphasizing the importance of caution and awareness in data protection by data controllers and lawyers.
1. Introduction
The privacy of personal life requires profound contemplation on how modern technological advancements affect the fundamental rights and freedoms of individuals. Digital transformation has made collecting and processing personal data easier, but it has also increased the risk of data misuse. Therefore, it is inevitable that legal regulations must meet the need to protect private lives and personal data.
Following the global precedents, the protection and privacy of personal data have gained significance in Türkiye. The 6698 Personal Data Protection Law (''KVKK'') is a fundamental legal regulation in Türkiye that addresses this crucial matter, governing the processing and protection of personal data. KVKK aims to ensure the privacy and security of personal data by providing a comprehensive framework for its processing and establishing fundamental rules in this regard.
In legal proceedings, submitting documents containing personal data as supporting evidence may be necessary. Regardless of the nature of the evidence, the privacy and protection of personal data within them are of utmost importance. This is one of the fundamental requirements of modern legal systems, reflecting respect for individuals' private lives and personal data. Therefore, personal data in evidence presented to the court must fully adhere to the provisions of the KVKK.
Failure to comply with the KVKK regarding personal data in evidence presented to the court may result in severe legal and criminal consequences. The KVKK prescribes the lawful collection and processing of personal data, incorporating essential principles, such as obtaining explicit consent, informing the data subject, and ensuring data security. Therefore, it is imperative for lawyers and parties involved in legal proceedings to ensure strict adherence to these rules when collecting and presenting evidence involving personal data.
This article will examine the scope of personal data protection legislation concerning documents and evidence presented to the court during legal proceedings.
2. Relationship Between Personal Data and Privacy
The close relationship between personal data and the privacy of personal life is a fundamental element emphasizing the importance of the concept of personal data and the necessity of its protection. In this context, the fundamental legal framework for the processing and protection of personal data in Türkiye was established through an amendment to the Constitution in the year 2010.
The KVKK explicitly states that personal data is protected under the right to privacy and confidentiality, as enshrined in the Constitution. A constitutional amendment has extended the protection of personal data as part of individuals' "right to privacy and protection," emphasizing individuals' entitlement to protect their personal data, encompassing rights like access, correction, or deletion without interference. Moreover, the processing of personal data is permissible only in accordance with the law or with explicit consent from the data subject. The KVKK, along with other relevant legal regulations, elaborately regulates the principles and procedures essential for the protection of personal data in this context.
These essential legal regulations provide an effective framework for protecting individuals' personal data while addressing the challenges posed by technological advancements. They respect the fundamental rights of individuals and enable the monitoring and control of personal data processing, thus striking a balance suitable for the needs of modern society.
3. Freedom of Claim and Defence
Freedom of claim and defence, an essential principle of the rule of law, is an integral part of a fair trial. This freedom grants individuals the right to assert their rights or defend themselves before judicial authorities without interference or fear. Essentially, freedom of claim and defence encompasses the right of individuals to protect their rights during judicial processes.
This right is rooted in Article 36 of the Turkish Constitution, detailed under the heading "Right to a Fair Trial." According to this article, everyone has the right to a fair trial by asserting and defending their rights before judicial authorities. This provides individuals with a fair chance during judicial proceedings and ensures the fulfilment of justice.
The right to a fair trial contributes to upholding the principles of legal equality and justice while assisting in maintaining the rule of law. It is designed to ensure that individuals are treated fairly by the judicial system and must operate in accordance with the universal principles of law. Consequently, freedom of claim and defence holds vital importance for the functioning of a democratic society and aids in preserving the rule of law.
4. The Right of Lawyers to Collect Information and Documents
Article 2/III of the Law on Lawyers grants lawyers significant authority and responsibility, especially in the preparation phase of lawsuits or legal proceedings. According to this article, lawyers have the right to collect relevant information and documents directly from public institutions and private organizations as determined by the law. This regulation empowers lawyers to review and/or copy official or private sector documents.
This authority provides an opportunity to effectively examine and utilize evidence held by parties involved in legal disputes during the preparation of cases. Collecting this information, particularly before a trial, significantly impacts the potential outcomes of a case. By utilizing these powers, lawyers can illuminate cases and effectively manage the process of presenting evidence to the court.
This regulation contributes to upholding the rule of law and facilitates the provision of justice. It ensures the effective operation of the flow of information in legal cases, expediting the functioning of courts. Consequently, Article 2/III of the Law on Lawyers is viewed as a critical component of the Turkish legal system concerning the provision of justice and the functioning of the law.
5. Burden of Proof
The principle of the "burden of proof," a fundamental principle of law, plays a critical role in the success of a lawsuit or legal process. According to this principle, in resolving a legal dispute, each party, whether plaintiff or defendant, bears the responsibility to prove the facts supporting their claims unless the law explicitly states otherwise. In other words, any individual or organization party to a lawsuit must substantiate their claims with concrete and convincing evidence (Toraman, 2015). This principle is vital for ensuring justice and the operation of the rule of law, as it allows courts to make objective and fair decisions. The burden of proof is the guarantee of an equitable trial process for both parties, preserving the credibility and effectiveness of the law.
6. Use of Unlawfully Obtained Personal Data as Evidence
Evidence obtained in violation of the law cannot be admitted in a legal process. This principle significantly contributes to upholding the rule of law and facilitating the administration of justice.
Especially when it comes to the use of personal data as evidence in legal proceedings, adherence to this principle is of great importance. Personal data often contains sensitive information relating to the privacy and security of private life. Therefore, assessing the lawfulness of obtaining this data and maintaining confidentiality are fundamental factors in determining the validity of evidence in a legal matter.
Where personal data has been unlawfully obtained, the court usually rejects its use in legal proceedings. Unlawfully obtained data may include information collected outside the bounds of the law or unauthorized intrusion into someone else's private life. When presented as evidence in a court case, such data will not be considered and will not be accepted as evidence by the court.
Therefore, when contemplating the use of personal data in a legal process, it must be ensured that this data has been acquired in compliance with the law. Otherwise, there is a risk that the court may reject it as evidence. This is a fundamental step to ensure the administration of justice and the proper functioning of the law.
The conditions for processing personal data are detailed in Article 5 of the KVKK. The legal reasons for processing special categories of personal data are more limited and are regulated under Article 6 of the KVKK. When processing special categories of personal data, adequate measures determined by the Data Protection Board must be taken. Additionally, personal data must be processed in accordance with the principles of " lawfulness and fairness," "being accurate and kept up-to-date where necessary," "being processed for specified, explicit, and legitimate purposes," "being relevant, limited, and proportionate to the purposes for which they are processed," and "being retained for the period prescribed by the relevant legislation or required for the purpose for which they are processed."
According to Article 5 of the KVKK, in cases where the data subject's explicit consent is not present, personal data may be processed only when such processing is:
- Clearly prescribed by laws,
- Necessary for the protection of life or physical integrity of the data subject or another person who is unable to express their consent due to physical impossibility or whose consent is not deemed legally valid,
- Concerning the personal data of parties involved in a contract and is necessary and directly related to the establishment or performance of that contract,
- Necessary for the data controller to fulfil its legal obligation,
- Pertaining to the personal data made public by the data subject themselves,
- Necessary for the establishment, exercise, or protection of a right,
- Necessary for the legitimate interests of the data controller, provided that it does not violate the fundamental rights and freedoms of the data subject.
Accordingly, any personal data presented to the court during the adjudication process must have been acquired lawfully. In the decision dated March 11, 2021, and numbered 2021/2301, the Personal Data Protection Board evaluated the acquisition and sharing of the personal data from the data subject, which was obtained through interrogation by their former spouse, who is an employee of a public institution. In this decision, the Board concluded that the acquisition not requested by the data subject and the subsequent sharing with the court did not comply with data security obligations.
According to the decision numbered 2021/1111 dated November 02, 2021, of the Personal Data Protection Board2, an administrative fine was imposed on a lawyer who accessed and submitted to the court the criminal record information of the witness being heard as the defendant. This decision was based on the grounds that obtaining and submitting criminal record information to the court did not adhere to the processing conditions for special category personal data outlined in Article 6 of KVKK. Based on the assessment conducted by the Personal Data Protection Board, it has been established that lawyers are not granted automatic access to the criminal record information of relevant individuals. Consequently, the criminal record information of the relevant individual has been unlawfully obtained by the data controller. Therefore, it has been concluded that the personal data processing activities conducted by the data controller regarding the relevant individual are unlawful. The crucial consideration revolves around whether the lawyer can be deemed a data controller. For a lawyer to fall under the classification of a data controller, they must be in a position to determine the purposes and means of processing personal data.
Furthermore, in the decision of the Constitutional Court dated February 3, 2022, regarding the application numbered 2019/204733, an individual application was reviewed. In essence, it was emphasized that the effective investigation and prosecution of whether the use of unlawfully obtained personal data as evidence constituted a crime in terms of personal data protection should be carried out under the Turkish Criminal Code (''TCK'').
In the aftermath of these decisions, debates surrounding the subject persist, notably complicating the burden of proof for the involved parties. A clear answer to whether personal data or the right to a fair trial should take precedence has yet to be provided. To prevent potential rights violations, it is crucial to strike a balance between the right to protect personal data and the right to a fair trial. It would be more appropriate to subpoena documents through the court if their nature has the potential to violate the KVKK.
Using personal data as evidence in a dispute without lawful acquisition, sharing personal data unrelated to the subject matter of the case even if lawfully obtained, or presenting such data in court files without judicial authorities' request and without the explicit consent of the individuals concerned, particularly regarding special category personal data, may fall under the purview of the KVKK and the TCK. Furthermore, if these actions are carried out by lawyers, legal, criminal, and disciplinary responsibilities will come into play in accordance with the Law on Lawyers (Boran Güneysu & Memiş, 2019).
7. Conclusion
In the complex legal framework where data protection and the rule of law principles converge, essential regulations such as the KVKK and the TCK establish crucial rules and responsibilities governing the utilization of personal data in legal proceedings.
The presentation of personal data obtained or shared in violation of the KVKK as evidence in disputes can result in severe consequences. In such instances, administrative sanctions for data controllers and the potential for criminal investigations against individuals, whether natural or legal persons acting as data controllers, may arise. Particularly in situations involving the unlawful collection or sharing of personal data, the penalties outlined by the KVKK and TCK may be applicable.
For instance, obtaining or using personal data unlawfully implies an infringement of individuals' privacy. Data controllers who present personal data as evidence in a dispute without legal grounds or the explicit consent of the individuals involved are evaluated within the framework of the KVKK and TCK.
It is crucial to obtain and utilize personal data in compliance with the framework set by the KVKK. Therefore, both data controllers and lawyers identified as data controllers should meticulously assess the processing, acquisition, and adherence to the provisions of the KVKK and TCK when handling personal data. The processing of sensitive personal data is especially subject to stricter regulations, and the necessity of obtaining explicit consent or complying with legal provisions for the lawful use of such data should not be overlooked. Additionally, during the processing of personal data, adherence to the general principles of the KVKK —such as lawfulness, fairness, accuracy, being processed for specified, explicit, and legitimate purposes, and being relevant, limited, and proportionate to the purposes for which they are processed—should be maintained.
In conclusion, ensuring compliance with the KVKK and TCK when employing personal data in a legal context is the key to upholding justice and the rule of law. Additionally, when personal data is utilized as evidence in the legal process, a thorough legal assessment should be conducted on a case-by-case basis. Therefore, both data controllers and lawyers should exercise caution and awareness in matters concerning data protection and the orchestration of legal processes, staying vigilant and informed about recent developments in this field.
References:
Boran Güneysu, N., & Memiş, B. (2019, Temmuz 2). Kişisel Verilerin Korunması Kanunu Kapsamında Avukatın Yükümlülük ve Sorumlulukları. AndHD, s. 313-337.
Toraman, B. (2015). Medeni Usul Hukukunda İspat Hakkına Dair Bazı Tespit ve Değerlendirmeler. Dokuz Eylül Üniversitesi Hukuk Fakültesi Dergisi C. 16, Özel Sayı, s. 1483-1523.
Footnotes
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
