In addition to the conveniences brought by the digital age, the protection of personal data has become one of the most important legal issues of our time. Especially in a dynamic and densely populated city like Antalya, the collection, processing, or sharing of individuals’ personal data without their consent is a violation that can have serious legal consequences. The right to privacy, guaranteed by the Constitution of the Republic of Turkey, has been given a more concrete basis by the Personal Data Protection Law (KVKK). In this article, we will examine the rights of individuals against the unauthorized collection of personal data, the legal remedies available, and the details of these processes, specifically in Antalya. Our goal is to inform everyone who has suffered, or is at risk of suffering, and to help them effectively exercise their rights.
What is Personal Data and Why Should It Be Protected?
In order to combat the unauthorized collection of personal data, it is first necessary to understand the concept of personal data correctly.
Definition of Personal Data
According to Article 3 of the Personal Data Protection Law, personal data is defined as “any information relating to an identified or identifiable natural person.” This definition is quite broad and encompasses all information that directly or indirectly identifies a person. For example, your name, surname, Turkish ID number, address, telephone number, email address, bank account information, health information, ethnic origin, political views, religious beliefs, fingerprints, voice recordings, photographs, and even your IP address and location information constitute personal data. This data is an integral part of an individual’s private life and is legally protected.
The Importance of Personal Data Protection
Personal data protection is recognized as a constitutional right in modern legal systems. Article 20 of the Constitution of the Republic of Turkey clearly states that everyone has the right to have their private life respected, and that personal data may only be processed in cases prescribed by law or with the individual’s explicit consent. Personal data protection safeguards the privacy, security, and freedom of individuals. In the increasingly digital world, the acquisition or unauthorized use of personal data by malicious individuals can lead to serious harm, such as identity theft, fraud, and blackmail. Therefore, protecting personal data is not only a legal obligation but also a social necessity. In a city like Antalya, with its high tourist and commercial activity, the potential for such violations is even greater.
Unauthorized Collection of Personal Data and Unlawfulness
Collecting personal data without permission is an act expressly prohibited under the KVKK.
Unlawful Data Collection Act
Articles 5 and 6 of the Personal Data Protection Law (KVKK) define the necessary conditions for the processing of personal data (collection, recording, storage, etc.). The general rule is that personal data cannot be processed without the “explicit consent” of the relevant person. The law also provides for certain exceptional circumstances beyond explicit consent; for example, if it is expressly provided for by law, if it is necessary to protect the life or physical integrity of a person who is unable to give consent due to a practical impossibility or whose consent is not legally valid, if it is directly related to the establishment or performance of a contract, if it is necessary for the data controller to fulfill its legal obligation, if the data has been made public by the relevant person, if it is necessary for the establishment, exercise, or protection of a right, or if the processing is necessary for the legitimate interests of the data controller. However, beyond these exceptions, the collection of any person’s data without their consent constitutes an unlawful act.
Examples of Unauthorized Collection
Unauthorized collection of personal data can occur in various ways. For example:
* A business sharing its customers’ contact information with third parties or sending commercial electronic messages without their express consent.
* Taking photos, posts or other information of individuals from social media platforms or other websites without their consent and using them for other purposes.
* In telephone surveys, the data collected is not used or shared for purposes other than those specified.
* Failure to comply with the provisions of the KVKK during monitoring with camera systems (e.g., failure to fulfill the obligation to inform, collection of excessive data).
* An institution or organization processes its employees’ or customers’ health information and special personal data such as union membership without permission.
It is of great importance that hotels, shopping malls, entertainment venues or other commercial enterprises in Antalya act in accordance with KVKK in such data collection activities.
Legal Processes Within the Scope of the Personal Data Protection Law (KVKK)
An individual who believes that their personal data has been collected without permission can exercise their rights by following certain steps within the scope of the KVKK.
Rights of the Data Subject and Recourse
Article 11 of the Personal Data Protection Law (KVKK) grants broad rights to individuals whose personal data is being processed. These rights include the right to learn whether their personal data is being processed, to request information about it if it has been processed, to learn the purpose of processing and whether it is being used in accordance with its intended purpose, to know the third parties to whom personal data has been transferred, both domestically and internationally, to request correction of incomplete or inaccurate processing, to request deletion or destruction if the reasons requiring processing are no longer valid despite processing in accordance with the law or other relevant legal provisions, to request notification of corrections and deletion/destruction to third parties to whom personal data has been transferred, to object to any detrimental consequences arising from the analysis of processed data exclusively through automated systems, and to request compensation for damages suffered due to unlawful processing of personal data.
The data subject who wishes to exercise these rights must first apply in writing to the data controller (the person/institution that collects or processes the data) or through other methods determined by the Personal Data Protection Board (KVKK Article 13). The data controller is obligated to respond to the request within thirty days at the latest.
Personal Data Protection Authority (KVKK Authority) Complaint Process
If an application submitted to the data controller is rejected, the response is deemed insufficient, or the application is not responded to within the timeframe, the data subject may file a complaint with the Personal Data Protection Board (KVKK Authority) within thirty days of learning of the data controller’s response, and in any case, within sixty days of the application date (KVKK Article 14). The Board will review these complaints, make the necessary decisions, and may impose administrative fines on data controllers (KVKK Article 18). For an individual experiencing a data breach in Antalya, this process is a crucial step in pursuing their rights.
Lawsuits Against Unauthorized Data Collection
In addition to the complaint process to the Personal Data Protection Authority, there are two main legal remedies available to individuals who are victims of the unauthorized collection of their personal data: Criminal Case and Compensation Case.
Criminal Case Process
Unauthorized collection of personal data may constitute a crime under the Turkish Penal Code (TCK). Articles 135 to 140 of the TCK regulate crimes related to personal data. Specifically, Article 135 regulates the crimes of “Recording personal data,” Article 136 “Unlawfully providing or obtaining data,” and Article 138 “Failure to destroy data.” These crimes may be subject to a complaint or, in some cases, may be ex officio (self-prosecuted) investigations.
Anyone who learns that their personal data has been collected without permission can initiate criminal proceedings by filing a criminal complaint with the Chief Public Prosecutor’s Office. The Antalya Chief Public Prosecutor’s Office will meticulously evaluate such complaints, launch an investigation, and ensure evidence is collected. If the offense is proven, sanctions such as imprisonment or a judicial fine may be imposed on the individuals involved. This process acts as a deterrent, punishing perpetrators and preventing similar violations.
Compensation Case (Material and Moral)
An individual who suffers harm due to the unauthorized collection of their personal data has the right to file a lawsuit for pecuniary and non-pecuniary damages under the Turkish Code of Obligations. Such a lawsuit is based on the grounds that their personal rights have been violated as a result of the unlawful act (i.e., unauthorized data collection).
* Punitive Damages: Covers tangible and calculable losses incurred as a result of unauthorized data collection. For example, direct financial losses such as bank account empties due to identity theft, credit card fraud, and job loss may be claimed under pecuniary damages.
* Non-pecuniary damages: This claim is made for intangible damages such as grief, sorrow, distress, and loss of reputation resulting from the violation of personal rights. Unauthorized disclosure or use of personal data may undermine an individual’s spiritual integrity and social reputation. In such cases, non-pecuniary damages may be sought to compensate for the moral damage suffered.
Compensation lawsuits are generally heard in the Civil Courts of First Instance. The Civil Courts of First Instance within the Antalya Courthouse have jurisdiction and authority over such disputes. The plaintiff is responsible for proving that they have suffered damages and that this damage resulted from the unauthorized collection of their personal data.
Why is Legal Support Important?
Legal processes to address the unauthorized collection of personal data are quite complex and require technical expertise. The provisions of the Personal Data Protection Law (KVKK), articles of the Turkish Penal Code, and the relevant provisions of the Code of Obligations should be evaluated holistically. Any incorrect steps in this process could lead to loss of rights.
* Evidence Collection and Evaluation: Proving the act of unauthorized data collection often requires the collection and legal evaluation of digital evidence.
* Choosing the Right Application and Litigation Path: Which of the different paths, such as applying to the data controller, complaint to the Personal Data Protection Authority, criminal case or compensation case, should be followed, or which of them should be followed together, varies depending on the characteristics of the case.
* Formulation of Legal Arguments: In order for cases to be successful, legal arguments must be based on a solid foundation and presented in line with the relevant legislation and the precedents of the Supreme Court.
* Monitoring Deadlines: The application and lawsuit filing deadlines stipulated in the Personal Data Protection Law (KVKK) and related laws may be liable to legal action. Accurately monitoring these deadlines is crucial.
For individuals in Antalya who believe their personal data has been violated, seeking support from an expert law firm will ensure the right steps are taken throughout the process, their rights are fully protected, and the most effective legal solutions are achieved. A qualified attorney will thoroughly analyze their client’s situation, determine the most appropriate legal strategy, and provide professional guidance throughout the entire process.
The protection of personal data is one of the most fundamental rights of individuals, and legal remedies are available to address any violation of this right. For anyone experiencing such a grievance in Antalya, knowing their rights and not hesitating to seek professional legal assistance plays a critical role in their pursuit of justice. The legal system provides the necessary mechanisms to prevent violations in this area and compensate victims for their losses.