Penal Sanctions
Articles 135 and 140 of the Turkish Penal Code No. 5237, dated 26/9/2004, will be applied in terms of crimes related to personal data.
According to Article 135 of the Turkish Penal Code No. 5237, any person who unlawfully records personal data is sentenced to imprisonment from one to three years. This penalty is increased by half in accordance with the first paragraph in case the personal data is related to the political, philosophical or religious views of the persons, their racial origins, unlawful moral inclinations, sexual life, health conditions or affiliations.
According to article 136 of the Turkish Penal Code numbered 5237, a person who unlawfully gives, spreads or seizes personal data to another person is punished with imprisonment from two to four years.
If the subject of the criminal offense to be imposed is the statements and images recorded in accordance with the fifth and sixth paragraphs of article 236 of the Criminal Procedure Code, the penalty is increased by one fold.
According to article 137, if these crimes are committed by the public officer by abuse of the authority given by his / her duty and by taking advantage of the convenience provided by a certain profession and art, the punishment is increased by half.
Although it has been processed in accordance with the legislation, if the reasons requiring its processing disappear, the personal data should be d, destroyed or anonymized by the data controller, either ex officio or upon the request of the person concerned. In case of contradiction; Those who do not or anonymize personal data are punished according to article 138 of the Turkish Penal Code.
According to this article, those who are obliged to destroy the data within the system despite the expiration of the periods determined by the law, if they fail to fulfill their duties, are sentenced to imprisonment from one to two years.
According to the provisions of the Criminal Procedure Code, if the subject of the crime is the data that needs to be eliminated or destroyed, the punishment to be imposed is increased by one fold.
In case of commission of crimes also defined about legal persons, security measures specific to them are imposed.
Misdemeanors and Administrative Fines
During the acquisition of personal data, the data controller or the person authorized by the person concerned; is obliged to inform about the identity of the data controller and its representative, for what purpose the personal data will be processed, to whom and for what reasons the processed personal data can be transferred, the method and legal reason for data collection, and other rights enumerated in the law.
An administrative fine from 5,000 Turkish lira to 100,000 Turkish lira will be imposed on those who fail to fulfill the envisaged disclosure obligation.
The data controller is obliged to take all necessary technical and administrative measures to prevent unlawful processing of personal data, to prevent unlawful access to personal data, and to ensure the appropriate level of protection in order to protect personal data.
An administrative fine from 15,000 Turkish lira to 1,000,000 Turkish lira will be imposed on those who fail to fulfill the obligations regarding the aforementioned data security.
The Board, as a result of the examination made upon the complaint or ex officio, in the event that the existence of the violation is detected, will decided to fix the unlawfullness by the data controller and notify the relevant parties. This decision is implemented without delay and within thirty days at the latest from the notification.
An administrative fine from 25,000 Turkish lira to 1,000,000 Turkish lira will be imposed on those who fail to comply with these decisions made by the Board.
Natural and legal persons who process personal data must register with the Data Controllers Registry before starting to process such data.
An administrative fine from 20,000 Turkish lira to 1,000,000 Turkish lira is imposed on those who violate this stipulated obligation to register and notify the Data Controllers Registry.
It may be possible to carry out the actions in question within public institutions and organizations and professional organizations that qualify as public institutions. In this case, upon the notification to be made by the Board, action is taken in accordance with the disciplinary provisions against the officers working in the relevant public institutions and organizations and other public officials and those working in the professional organizations that have the quality of public institutions. The result of this process is notified to the Board. Administrative sanctions are decided by the Board.
Administrative fines foreseen in article 18 of the Law on Protection of Personal Data will be applied to real and private law legal persons who are data controllers