Strict rules have been introduced in the processing and use of Personal Data within the scope of the Law on the Protection of Personal Data No.6698. Among the exceptions to these strict rules, "publicization" stands out as a term.
“Publicizing of Personal Data by the related person themselves”
This exception is directly included in one part of the law and cited in two different parts.
1- Exception to the requirement of "explicit consent", which is at the beginning of the conditions for processing personal data in Article 5 of the Law (Article 5/2/d)
2- With the reference made within the scope of subparagraph b of paragraph 2 of Article 28 of the Law.
a- " Obligation to Inform" in Article 10,
b- “The rights of data subject” who is the data owner included in Article 11.
c- "Data Controllers’ Registry" for those who are obliged to register in Article 16.
In the indirect transfer of Personal Data locally, it is observed that there is no need to obtain separate consent for publicized data. Since the exception in Article 5 of the Law mentioned above has been referred to sub-paragraph a) of paragraph 2 of Article 8, which regulates the transfer of personal data.
3- "Transfer of Personal Data Domestically" witihin the scope of Article 8 of the Law.
Although it can be presumed up until now that publicized data can be processed easily, that there is no obligation for clarification and it can be readily transferred domestically, general principles in Law article 4, specifically the article “Being relevant, limited and proportionate to the purpose for which it is processed” seriously narrows the utilization of publicized data.
What is Publicization? Scope and Limits
According to the Law on the Protection of Personal Data, the concept of "publicizing" is expressed as the public disclosure of the personal data of the person concerned. However, under the Law, "publicizing" has a narrower meaning than making personal data available to the public in any way; it is in a close relationship with the publicizing will of the person concerned and with the purpose of publicizing.
The fact that personal data which is open to the public and that it can be viewed or accessed by everyone does not allow this data to be processed or used by anyone.
When the examples given by the Board are examined, (...the contact information shared on this site by a person who puts his vehicle on sale through the website can only be used to purchase the vehicle or to obtain information about this advertisement, and cannot be used for any other purpose...) the purpose and way of making the data public and the purpose and method of using that public data should be compatible with each other.
A decision made by the Law on the Protection of Personal Data for an insurance company on 07.11.2019 is very significant in this regard.
“Pursuant to the complaint of the individual filed to the Board for being called about insurance promotions by an Insurance Company (Company) without his/her explicit consent, following the investigation on the name, surname and phone number of the plaintiff before
a proposal call was made by the financial assurance consultants and as a result of the evaluation of the Company’s plea about obtaining the information from the …extension website and that the name, surname and phone number were open to public on the indicated website, the following verdict was taken:
Even under the condition that the plaintiff’s personal information was accessed through the internet site which was made public by himself/herself, the plaintiff’s information was not used for the purpose for which it was displayed and publicized in the Internet; in other words, the Company did not attempt to reach the individual to benefit from his/her professional competencies but it did so with the intention of an appointment request related with the company’s activities. It was decided that the data processing performed by the company cannot be evaluated within the framework of the subparagraph (d) of paragraph (2) of Article 5 of the Personal Data Protection Law No.6698; however the Company should be enforced an administrative fine of 100.000 Turkish Liras in accordance with subparagraph (b) of paragraph (1) of Article 18 of the law by acting against subparagraph (a) of paragraph (1) of Article 12 of the Law of the same law by not taking all types of necessary precautions directed towards obtaining appropriate security levels for the prevention of unlawful processing of personal data within this content. “
As observed here, in order for the personal data to be accepted as publicized, it must be determined for what purpose the person concerned made his / her personal data public. Since publicization; is limited to the purpose of sharing the personal data of the data owner with the public. In the sample case, the individual has shared his contact information in case of necessity to exploit his professional competency. However, the insurance company "processed" the data by using it to reach the relevant person within the scope of a kind of marketing activity.
The reason for the verdict is the fact that the released in formation is not considered “publicized” within the content subparagraph "d" of paragraph 2 of Article 5 and the Company committed an unlawful processing of personal information by not distinguishing this fact and not taking necessary precautions.
We observe that the individuals responsible of the data act against law by personal data processing which differs from the reason of publicizing by the data owner or exceeding the intention by which the data was publicized.
The violation of the law here is mainly due to the general principles of the processing of Personal Data in Article 4 of the Law and especially the fact that the data is not in compliance with the principle of "being relevant, limited and proportionate to the purpose for which it is processed".
In this context, it is necessary to carefully examine the purpose of publicizing the data that is made public during the use or processing of the data shared on social media.