- Ali Kasım BAŞTAN
- Aug 14, 2025
- 5 min read
PERSONAL DATA PROTECTION LAW (KVKK) - I
CONCEPTS OF PERSONAL DATA, SPECIAL NATURE PERSONAL DATA, EXPLICIT CONSENT AND ANONYMIZATION
Personal data refers to data that determines or makes identifiable the owner's identity, such as a characteristic or affiliation with a person . Being identifiable or identifiable means that the data in question can be attributed to a specific person in any way. In this context, personal data includes not only information that allows for the precise identification of a person, such as their name, surname, and Turkish Republic ID number, but also information about their economic, family, social, religious, and political views. One of the most important characteristics of personal data is that it belongs to a natural person. Information that qualifies as personal data belonging to a legal entity cannot be considered personal data.
Personal data has existed since the beginning of human interaction. People in communication have shared information, often considered personal data, for various reasons. However, with the widespread adoption of technology and the internet in the 20th and 21st centuries, personal data has gained even greater importance. Personal data is disseminated online, particularly for advertising and similar purposes, and is even used and processed by various institutions and individuals. People encountering products they may like based on their physical characteristics, political or religious views, or being exposed to situations that could in any way be linked to this information, indicates that their personal data is being used. The protection of personal data comes into play here. Failure to protect personal data can lead to reckless processing or malicious use. For example, a person's Turkish Republic ID number is personal data. As a result of reckless processing, lack of protection, and dissemination of this data, malicious actors can unfairly impose liability on the person whose data is being processed, or they can be portrayed as having committed a crime they never committed. Protecting personal data is crucial to prevent such incidents, which could lead to even greater consequences. This protection prevents the unconscious collection of personal data, the unconscious processing of legally collected personal data, and malicious use.
Recognizing the importance of personal data , the Council of Europe has been working on the protection of personal data since the 1970s. As a result of these efforts, the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data was opened for signature on January 28, 1981. The primary objective of this convention is to prioritize the privacy and confidentiality of individuals against automatic processing of personal data belonging to individuals, regardless of nationality or place of residence in the signatory countries. Although Turkey was one of the first countries to sign this convention on January 28, 1981, the convention was incorporated into domestic law upon publication in the Official Gazette on March 17, 2016. Subsequently, the Protocol on Supervisory Authorities and Transborder Data Flows was incorporated into domestic law on May 5, 2016 , despite Turkey being one of the first countries to sign it .
The first regulation enacted in Turkish domestic law regarding the protection of personal data dates back to the Turkish Penal Code No. 5237, dated September 26, 2004. This law sanctioned the crimes of recording personal data, seizing personal data, and destroying personal data , and established criminal liability for those who committed these acts. Later, with the constitutional amendment of 2010, the protection of personal data was guaranteed by the Constitution. The following provision was added to Article 20 of the Constitution, which addresses the privacy of private life: " Everyone has the right to demand the protection of personal data concerning him/her. This right includes being informed about personal data concerning him/her, accessing such data, requesting its correction or deletion, and learning whether it is being used in accordance with its intended purposes. Personal data may only be processed in cases prescribed by law or with the individual's explicit consent. The principles and procedures regarding the protection of personal data shall be regulated by law." Although these regulations have been implemented, the need for a law that addresses personal data more comprehensively has emerged . As a result of these efforts, Law No. 6698 on the Protection of Personal Data was published on March 24, 2016. This law provides guidance on how to protect and process personal data. The aim of this law is to completely prevent the unauthorized processing and dissemination of personal data.
Personal Data Protection Law No. 6698 mandates the Personal Data Protection Authority to oversee the lawful processing and protection of personal data collected by institutions and organizations for various reasons. This authority was established on January 30, 2017, to fulfill the requirements of Law No. 6698. The duties of this institution are listed in Article 20 of Law No. 6698.
Article 20 of the Personal Data Protection Law states: “(1) The duties of the institution are as follows:
a) To follow the practices and developments in legislation, to make evaluations and recommendations, to conduct research and examinations or to have them conducted, in accordance with the scope of its duties.
b) To cooperate with public institutions and organizations, non-governmental organizations, professional organizations or universities on matters falling within its scope of duty, when necessary.
c) To monitor and evaluate international developments regarding personal data, to cooperate with international organizations on matters falling within its scope of duty, and to participate in meetings.
d) To submit the annual activity report to the Presidency and the Turkish Grand National Assembly Human Rights Investigation Commission (…).
d) To fulfill other duties assigned by law.”
The Authority is generally responsible for monitoring developments in the field of personal data protection and taking action accordingly. It is also authorized to impose administrative fines when violations specified in Article 18 of the Personal Data Protection Law are discovered.
Important concepts regarding personal data are included in Law No. 6698 on the Protection of Personal Data. These concepts are fundamental and have been clarified by the legislator. However, it is beneficial to review them.
1-) Special Personal Data
We've discussed in detail what personal data is, but its special nature makes it even more important and in need of protection in some situations. Special personal data includes information such as a person's race, political views, religion and sect, membership in associations and foundations, health, and genetic information. The processing of such data is subject to more stringent conditions.
2-) Explicit Consent
The concept of explicit consent, one of the most important conditions for processing personal data, is addressed in numerous articles of the law. It is also an important concept found in international texts. Explicit consent is the consent of a person to a request for processing of their data, either by the person themselves or by a third party. The law specifies three elements of explicit consent.
∙ It should be related to a specific subject: It should be clear which data and which transactions the consent will cover.
∙ It is based on information: Before giving consent, the person is informed in detail about what the consent will cover.
∙ Expression of free will: Consent is expressed freely, without any influence or pressure.
3-) Anonymization
Anonymization is defined as the process by which the data subject's identity is not determined or identifiable, even when matched with other data. In other words, anonymization means that the data is no longer attributable to the subject and cannot be attributed to anyone else. Data processing resulting from anonymization is permitted only if certain conditions are met.
Comments