Process of Publicized Personal Data

According to the Article 5/2/d of Turkish Personal Data Protection Law (“Law”), in case personal data is made public by the data subject itself, data processors may process such publicized personal data without explicit consent of the data subject. However such permission does not mean that data processors may process such data without any limitation. In this article you may find brief explanations on key points that should be taken into consideration while processing publicized personal data.

What Kind Of Publicized Personal Data Can Be Processed Without Explicit Consent?

When grammatical interpretation of the relevant article is taken into consideration, personal data should be made public by the data subject itself. That means, publicized personal data that is made public by third parties should not be processed based on this condition. Thus, data processors should ensure whether personal data is made public by the data subject itself or not.

Turkish Data Protection Authority has also underlined the importance of data subject’s will to make personal data public, with the public announcement dated 16/12/2020. The personal data that is made public by the data subject without its will, (i.e. by mistake or another reason) should not be processed under this exception.

In addition, since there is not such exception regarding process of special categories of personal data; if there is not another legal base for processing such data, data processors will need to prove explicit consent of the data subject, even it is made public by the data subject itself. Thus, data processors should not process personal data based on the exception regulated under Article 5/2/d while processing personal data relating to:

• race,
• ethnic origin,
• political opinion, philosophical belief,
• religion, religious sect or other belief, 
• appearance,
• membership to associations, foundations or trade-unions,
• health,
• sexual life,
• criminal convictions and security measures,
• biometric and genetic data

Purpose Of Making Personal Data Public Is Also Important!

According to the Turkish Data Protection Authority, data processors may process publicized personal data without explicit consent of the data subject provided that, purpose of processing is in line with purpose of making personal data public. In example, it will be contrary to the Law if data processor obtains personal data of the data subject from its social media account in order to process it with marketing purposes ¹.