PUBLIC ANNOUNCEMENT ABOUT THE FULFILLMENT OF THE DISCLOSURE OBLIGATION

Within the framework of the Personal Data Protection Law No. 6698, secondary legislation related to the Law and the decisions made by the Personal Data Protection Board, data controllers have certain obligations. One of these obligations is the obligation to inform in Article 10 of the Law.

While the obligation to inform is an obligation for data controllers, it is also a right for natural persons whose personal data are processed. The obligation to inform, which means informing the relevant person about his personal data being processed, is an indispensable condition for personal data processing to be carried out in accordance with the law.

Fulfilling the obligation to inform is not an obligation dependent on the request of the relevant person. In addition, the data controller must fulfill its obligation to inform when processing personal data in cases where the relevant person’s explicit consent or one of the other personal data processing conditions is present. Because the obligation to inform is an obligation that must be fulfilled in all cases, regardless of explicit consent or other personal data processing conditions listed in the Law.

As a result of the evaluation made on the information and documents submitted to the Institution by the relevant data controllers upon notification and complaint applications made to our Institution or other documents intended to be examined and researched by the Board;

Clarification was not made by the data controller at the time the personal data was obtained from the data subject, was made later, or was not made at all,
The lighting content does not cover the issues listed in Article 10 of Law No. 6698,
In lighting; Expressions are used that suggest that the purpose of processing personal data is not limited to the processing activity, specific, clear or legitimate, and that personal data may be processed for other purposes that may arise in the future,
“Legal reason” and “purpose of processing”, which are the minimum elements of disclosure, are used interchangeably or the legal reason element is not included at all,
In the texts used for clarification purposes, understandable, clear and simple language is not used, and information that is general, susceptible to different understandings, incomplete, misleading to the relevant people and incorrect is included,
In the lighting process, the purpose of transmission and the transmitted recipient group or groups are not given sufficient attention,
Information texts are “privacy policies” or “data processing policies”, which are generally not limited to the processing activity and are general data processing documents for the data controller,
Information texts are not presented on a platform that can be easily accessed by the relevant person,
When the layered lighting method is preferred, basic information is not presented at the first stage, before the relevant people are directed to another medium for detailed information, appropriate ways and methods are not followed to access detailed information, and they are generally directed to privacy policies or data processing policies,
Explicit consent and information are presented together under the same title in the same text or platform,
Confirmation that lighting has been provided is requested and if the approval is not given, the service is not provided.
It has been determined that there are deficiencies and violations of the legislation such as.

In order to avoid the sanctions specified in the Law due to such deficiencies and non-compliance with the legislation, data controllers must pay particular attention to the following issues while fulfilling their obligation to inform:

a) Proof that the disclosure obligation has been fulfilled belongs to the data controller.

b) The obligation to inform must be fulfilled by the data controller or the persons authorized by him/her when personal data is obtained from the relevant person.

c) The information to be provided within the scope of the obligation to inform shall, at a minimum, include the identity of the data controller and his/her representative, if any, in Article 10 of the Law, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method and legal reason for collecting personal data, and Article 11 of the Law. It must include the “data subject rights” listed in the article.

d) According to the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation published in the Official Gazette dated 10.03.2018; If the personal data is not obtained from the relevant person due to actual impossibility or inability to reach the relevant person, within a reasonable period of time after the personal data is obtained, or during the first communication if the personal data will be used for communication purposes with the relevant person, and if the personal data is to be transferred, at the latest During the first transfer of data, the obligation to inform the relevant person must be fulfilled.

e) The purpose of personal data processing to be disclosed while fulfilling the disclosure obligation must be limited to the processing activity, specific, clear and legitimate. Statements that suggest that personal data may be processed for other purposes that may arise in the future should not be used.

f) An understandable, clear and simple language must be used in the texts to be used when fulfilling the disclosure obligation. Additionally, general, vague, incomplete, misleading and incorrect information should not be included.

g) “Purpose of processing” and “legal reason” are separate elements that must be included in the notification to be made to the relevant persons while fulfilling the obligation to inform, and with the expression “legal reason” of data collection, it is determined on which of the processing conditions specified in Articles 5 and 6 of the Law that the personal data are processed. It should not be forgotten that it is meant

h) Privacy policies or data processing policies, which are not limited to the processing activity and are a general data processing document for the data controller, should not be used as clarification texts.

i) Care should be taken to ensure that the lighting is easily accessible and noticeable, and methods that would make it difficult for relevant persons to access the lighting should not be used.

j) In cases where personal data is transferred, the purpose of the transfer and the recipient group or groups to be transferred should also be included in the disclosure.

k) If the layered clarification method is preferred, before directing the relevant persons to another medium for detailed information, it should be ensured that basic information (for example, the identity of the data controller and the purpose of data processing) is presented at the first stage, and it should be noted that the directed texts have content limited to the processing activity.

In this context, data controllers, while fulfilling their obligation to inform, must act in accordance with Law No. 6698, the Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation of Disclosure, the Board decisions published on the Institution’s website, and the Guide for Fulfillment of the Obligation of Disclosure prepared by our Institution.

It is announced to the public with respect.