The purpose of the protection of personal data is to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data. In this context, there are obligations of real and legal persons who process personal data and the procedures and principles to be followed.
Personal data can only be processed in accordance with the procedures and principles stipulated in the relevant Law and other laws, and there are principles to be followed in the processing of personal data. Some of these are the principles of compliance with the law and the rules of honesty, being accurate and up-to-date when necessary, and processing for specific, clear and legitimate purposes.
The most important issue regarding the processing of personal data is that personal data cannot be processed without the express consent of the person concerned, except for the exceptions written in the law. Another issue is personal data of special nature. Paragraph 1 of article 6 of the Law defines special nature personal data. In the law, these are counted as individuals' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data. It is also forbidden to process private personal data without the express consent of the person concerned, except for the exceptions written in the law.
Although it has been processed in accordance with the provisions of the relevant law, in the event that the reasons for its processing disappear, personal data are d, destroyed or anonymized by the data controller, either ex officio or upon the request of the person concerned. According to the article 3 clause ı of the Law, data controller refers to the real or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
According to the Article 11 of the Law on the Protection of Personal Data, individuals have the right to request information on their personal data by applying to the data controller. These are to learn whether their personal data is being processed, to request information on this, to learn the purpose of processing personal data and whether they are used for their purpose, to know the third parties to whom personal data is transferred in the country or abroad, to request correction of personal data in case of incomplete or incorrect processing, personal data, right to request the deletion or destruction of the data, to demand the compensation of the damage in case of damage due to the unlawful processing of personal data, and to demand other rights specified in the law.
The person concerned submits his requests regarding the implementation of the law to the data controller in writing or by other methods determined by the Board. Board refers to the Personal Data Protection Board. In case the application is rejected, the response is found to be insufficient or the application is not answered in time; The person concerned can make a complaint to the Board within thirty days from the date he learns the response of the data controller, and in any case, within sixty days from the date of application. Those whose personal rights are violated reserve the right to compensation according to general provisions.
In terms of crimes related to personal data, the provisions of Articles 135 and 140 of the Turkish Penal Code No. 5237 are applied. In violation of the provision of Article 7 of the Personal Data Protection Law; Those who do not or anonymize personal data are sentenced to imprisonment from one year to two years according to Article 138 of the Turkish Penal Code numbered 5237. There is also an administrative fine according to the relevant law.
Administrative fines to be imposed by the Board are regulated under the title of Misdemeanors, article 18 of the Personal Data Protection Law. Administrative fines, the amount of which is regulated in the relevant article of the law, will be imposed by the Board to the real person and private law legal person data controllers who do not fulfill the obligations given according to this article.
Those who do not fulfill the obligations of disclosure, those who do not fulfill the obligations regarding data security, those who do not fulfill the decisions made by the Board, and those who violate the obligation to register and notify the Data Controllers Registry will be given administrative fines in the amounts specified in this article.
It is regulated in the law that if the actions are carried out within the public institutions and organizations and professional organizations in the nature of public institutions, the action will be taken according to different provisions and the result will be notified to the Board.
The Personal Data Protection Authority, which has administrative and financial autonomy and a public legal personality, has been established to fulfill the duties assigned by the law. The Authority consists of the Board and the Presidency. The decision making body of the institution is the Board.
In summary, the law determines the legal framework, responsibilities as well as obligations regarding the protection of personal data, introducing regulations on who will collect data, for what purposes, how it will be used and how it will be destroyed, and aims to protect the fundamental rights and freedoms of individuals, especially the privacy of private life..