In the Official Gazette of 22 March 2024, number 32497, was published the decision of the Constitutional Court of 13 February 2024, number 2020/36976, regarding the claim that the right to request the protection of personal data had been violated due to the lack of an effective criminal investigation into the complaint that personal data had been unlawfully obtained.
The applicant filed a criminal complaint with the Samsun Chief Public Prosecutor's Office (Chief Public Prosecutor's Office) on 9/10/2020, alleging that his employer, who terminated his employment contract, examined his account movements without his knowledge and consent in order not to pay his labour receivables.
The Public Prosecutor's Office, however, decided not to prosecute, stating that
the mere disclosure of personal data to others through the senses does not constitute the offence of unlawful acquisition of personal data, but that the offence of invasion of privacy may be considered if certain conditions are met.
The applicant appealed to the Criminal Peace Court on the grounds that the Public Prosecutor's Office had misjudged the nature of the offence as a result of its decision on the file, without collecting the evidence and hearing the testimony of the other party,
without verifying whether the evidence of bank account movements had been obtained in accordance with the law, and that an effective criminal investigation had not been carried out to establish the material truth. The Criminal Peace Court decided to reject the appeal definitively on the grounds that there was no error in the decision. The applicant filed an individual appeal against the final decision.
The Constitutional Court stated that;
- Personal data refers to all information relating to a person and includes not only information that reveals the identity of the individual, such as name, surname, date and place of birth, but also any data that makes the person directly or indirectly identifiable, such as telephone number, vehicle registration number, social security number, passport number, personal history, pictures, image and sound recordings, fingerprints, health information, genetic information, IP address, e-mail address, shopping habits, hobbies, preferences, people with whom he interacts, group memberships, family information,
- That the right to the protection of personal data aims to protect the rights and freedoms of the individual in the processing of personal data as a specific form of protection of human dignity and the right to free development of the personality,
- Article 12 of the Constitution excludes negative attitudes and behaviours that are directed against and harm the personal values of individuals,
- In the light of Article 5 of the Constitution, the State is obliged not to interfere arbitrarily with the individual's right to the protection of personal data and to prevent attacks by third parties, and that it has positive obligations in this regard,
- The right to request the protection of personal data had been violated within the framework of the right to respect for private life guaranteed by Article 20 of the Constitution.
As a result, the Constitutional Court ruled that the right to request the protection of personal data had been violated. Therefore, it was decided to send the case to the Samsun Chief Public Prosecutor's Office for re-investigation in order to eliminate the consequences of the violation of the right to request the protection of personal data within the framework of the right to respect for private life.
This decision reaffirms the following existing obligations. In case of violation of these issues, not only administrative fines may be imposed under Law No. 6698 on the Protection of Personal Data, but also penalties under the Turkish Penal Code.
- To take the necessary measures to process and protect the personal data of employees in accordance with privacy policies and legal regulations.
- Not to obtain employees' personal information without authorisation and to use such information only within legal and ethical limits.
- Establish and limit the controls and authorisations required for access to employees' personal information.
- Obtain legal advice before the employer takes any action, such as reviewing or obtaining employees' personal information, and act in accordance with any necessary legal processes.
Eylül Bengisu Gümüş, Senior Associate