The Personal Data Protection Board (“Board”) issued its decision dated 18.02.2020 and no. 2020/138 regarding the submission of the medical report in the personal file to the Court by the data controller to be used in the defence of the case. The decision was published on the website of the Personal Data Protection Board on 19.03.2021.
In the complaint submitted to the institution, it was stated that in the reemployment lawsuit filed against the data controller employer due to the unilateral termination of the employment contract of the relevant person, although it is not related to the content of the case, her/his sensitive personal data belonging to her/him in the personal file was submitted to the case file even though the court did not request it. Also, it has been stated in the complaint that, even though a diagnosis has not been made by the relevant health institution, by putting the expressions such as "specialist" or "expert" in the health reports in capital letters as an institution authorized to make psychological diagnoses, discussing the reports in the lawsuit violates her/his personality rights In line with the above explanations, the complainant requested the establishment of the necessary procedures against the data controller following the Law on Protection of Personal Data No.6698 (“the Law”).
Within the framework of the investigation initiated by the Board, a defence was requested from the data controller. In this context, the data controller claimed that under Article 15 of the Occupational Health and Safety Law No. 6331, employers had to carry out health examinations of their employees and that according to the provisions of the Occupational Health and Safety Regulation, they could keep the personal health files of the employees for at least 15 years from the date of their dismissal, and claimed that their health data were processed by the Law. In addition, the data controller stated that the said reports were submitted by the person concerned, as an excuse for leave requests without any justification and that the employee's employment contract was terminated with justified reason according to Article 25 of Labour Law No. 4857. Also, it was argued that the data controller was requested by the Court to send all the contents of the personal file of the relevant person to them, and in this context, the entire content of the personal file requested by the court was shared with them without discriminating any information and documents, including the medical reports subject to the complaint. In this respect, it was also stated that the reports subject to the complaint were submitted to the court by the Law and the good faith and in connection with the purpose for which they were processed to prove the material facts related to the company defence and termination of the employment contract.
In the examination carried out by the Board on the subject, it was pointed out that in accordance with the provision of Article 5 of the Law titled "Personal data processing conditions", personal data cannot be processed without the express consent of the relevant person, but in the event of one of the following conditions below, it is possible to process personal data without seeking the explicit consent of the relevant person. These conditions are as follows; When,
- It is clearly stipulated in the laws,
- It is compulsory for the protection of the life or physical integrity of the person who is unable to disclose their consent due to actual impossibility or whose consent is not legally valid,
- It is necessary to process personal data belonging to the parties of the contract, provided that it is directly related to the establishment or performance of a contract,
- It is mandatory for the data controller to fulfil their legal obligation,
- It is made public by the relevant person,
- Data processing is mandatory for the establishment, use or protection of a right,
- Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.
Apart from this, the Board stated that under paragraph 1 of Article 219 of the Code of Civil Procedure numbered 6100, the parties are obliged to submit to the court all the documents they or the other party rely on as evidence. Following Article 220 of the aforementioned Law, if the party who is decided to submit the document, does not submit the document within the given period and does not show an acceptable excuse for not submitting the document with the evidence or denies that the document is in its possession, the court would be, depending on the circumstances, accept the statement of the other party. In the concrete case, the Board found that in the notification written by the court regarding the case, it has been observed that a certified copy of the entire contents of the personal file of the plaintiff/relevant person was requested from the defendant/data controller.
Based on the evaluations of the Board, it has been decided that there is no action to be taken regarding the issue, considering the provisions of "Processing of personal data by judicial authorities or execution authorities in relation to the investigation, prosecution, trial or execution proceedings" included in Article 28 of Law and the clause (b) of Article 6 titled "Petitions that cannot be examined" of the Law No. 3071 on the Exercise of Petition Right which regulates that petitions submitted to or sent to the Grand National Assembly of Turkey or competent authorities related to matters falling under the jurisdiction of the judicial authorities cannot be examined.