Introduction
Law no. 7499 Amending the Code of Criminal Procedure and Certain Laws has introduced some anticipated changes to Law no. 6698 on the Protection of Personal Data (“KVKK”) upon its publication in Official Gazette no. 32487 of March 12, 2024. The amended provisions of the KVKK entered into force on June 1, 2024. As part of the long-awaited revision of the KVKK, these amendments are an important step towards harmonizing the Turkish personal data protection legislation with the European Union General Data Protection Regulation (“GDPR”).
What Are Special Categories of Personal Data?
Special categories of personal data refer to data that, if disclosed, may result in the discrimination or victimization of the data subject. Therefore, they require better protection than other types of personal data. Special categories of personal data may be processed with the explicit consent of the data subject or in cases specified by law. They are listed in the Law and cannot be expanded by comparison to other data. They concern people’s data relating to their race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, as well as data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data.
Processing of Special Categories of Personal Data
Prior to the amendments of June 1, 2024, the Law also made a distinction between special categories of personal data and required different conditions for the processing of personal data relating to health and sexual life and other cases where special categories of personal data can be processed without explicit consent. Accordingly, special categories of personal data could be processed without the data subject’s explicit consent as follows:
- Special categories of personal data, except for those concerning health and sexual life may be processed in the cases provided for by laws, whereas
- Personal data concerning health and sexual life may only be processed by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.
With the amendments, there is no longer a distinction between data relating to health and sexual life and other special categories of personal data, and the legal requirements for the processing have been expanded. Accordingly, special categories of personal data may be processed if:
- The data subject has given explicit consent,
- It is explicitly provided for in the laws,
- Processing is necessary for the protection of the life or physical integrity of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent,
- Processing relates to the personal data made public by the data subject and complies with their will to make it public,
- Processing is necessary for the establishment, exercise or protection of a right,
- Processing by the persons subject to secrecy obligation or competent public institutions and organizations is necessary for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing,
- Processing is necessary for the fulfillment of legal obligations in the areas of employment, occupational health and safety, social security, social services and social welfare,
- Processing is carried out by a foundation, association or any other not-for-profit organization or entity with a political, philosophical, or trade union aim and on condition that the processing relates to its current or former members or to persons who have regular contact with it, provided that the processing is in accordance with its purposes and the legislation concerning it, is limited to its fields of activity, and the data is not disclosed to third parties.
Amendments’ Implications for the Current Practice
It is now possible to process special categories of personal data not only with the explicit consent of the data subject and in cases provided for by the laws, but also in special cases, e g. for the protection of the life or physical integrity of persons who are physically incapable of giving consent. Processing is also allowed for certain purposes, such as the provision of health services or the fulfillment of certain legal obligations. Consequently, the amendments provide flexibility in the processing of special categories of personal data, which may optimize data processing, especially in sensitive areas such as healthcare. Meanwhile, the requirement to take adequate measures determined by the Board ensures data security and the supervision of data processing processes. In this context, data controllers must comply with the new requirements while processing data and take the necessary legal and technical measures.
Conclusion
The amendments to the KVKK, valid as of 1 June 2024, introduce significant changes regarding the processing of special categories of personal data, where there is now more flexibility. Thus, more efficient data processing will be possible, especially in sensitive areas such as healthcare. However, it should be noted that while the amendments provide flexibility to data controllers, they also require more responsibility, care and strict adherence to data security and compliance standards.
