The Personal Data Protection Authority (“Authority”) issued statements through a public announcement published on 16.12.2020 (“Announcement”), regarding personal data of the data subjects made public in accordance with the personal data processing activities. In the Announcement, the Authority stated that making public should be interpreted in a different and narrow manner compared to disclosing personal data to the public; it should be defined as disclosing personal data to the public by the data subject with the intention and purpose to make the personal data public.
The Authority, regarding the personal data processing activities which are carried out in accordance with Article 5 of the Personal Data Protection Law numbered 6698 (“PDP Law”), stated that;
- It is not sufficient for the data subject to keep their personal data accessible to everyone, the data subject should have the intention towards making public,
- The purpose of making public is limited to sharing with the public,
- If the data controllers process the personal data in a manner which does not coincide with the data subject’s intent of making public, the processing in question shall be deemed against the PDP Law as long as the data processing is not based on another data processing condition.
Within this scope, the Authority referred to a decision made by the Personal Data Protection Board on 07.11.2019, and emphasized that, in data processing activities which are carried out within Article 5/2-d of the PDP Law, the intention of the data subject and the purpose of making public should be determined correctly and the processing activity should comply with the principles listed in Article 4 of the PDP Law.
You may reach the full Turkish version of the Public Announcement via the link below:
https://www.kvkk.gov.tr/Icerik/6843/-ALENILESTIRME-HAKKINDA-KAMUOYU-DUYURUSU
