PdPL
Corporate
PdPL
PERSONAL DATA PROTECTION LAW
Law Number : 6698 Acceptance Date : 24/3/2016
Official Gazette Published : Date : 7/4/2016 Published Code : Order : 5
Issue : 29677 Volume : 57
FIRST PART
Purpose, Scope and Definitions
Purpose ARTICLE 1- (1) The purpose of this Law is to protect the fundamental rights and freedoms
of individuals, especially the privacy of private life, in the processing of personal data, and to regulate the
obligations of natural and legal persons who process personal data and the procedures and principles to be followed.
Scope
ARTICLE 2- (1) The provisions of this Law shall apply to natural persons whose personal data are processed and to natural and legal persons who process this data fully or partially automatically
or non-automatically provided that they are part of any data recording system.
Definitions
ARTICLE 3- (1) In the implementation of this Law;
a) Explicit consent: Consent related to a specific subject, based on information and expressed with free will, b)
Anonymization: Personal data cannot be used in any way, even by matching it with other data. c) Chairman: The President of the Personal Data Protection Authority, ç) Relevant person: the
natural person whose personal data is processed, d)
Personal data: All kinds of information regarding an
identified or identifiable natural person, e) Processing of personal data: Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making
available personal data by fully or partially automatic or non-automatic means provided that it is a part of any data recording system, all kinds of operations on data such as classification or prevention of its use, f) Board: Personal Data Protection Board, g) Institution: Personal Data Protection Authority, ÿ) Data processor: Real or legal person who processes personal data on behalf of the
data controller based on the authority given to
him. , h) Data registration system: The registration
system in which personal data is processed and structured according to certain criteria,
ÿ) Data controller: Data controller, which determines the purposes and means of processing personal data,
The natural or legal person responsible for the establishment and management of the registration system, means.
SECOND PART Processing of Personal Data
General principles
ARTICLE 4- (1) Personal data can only be processed by the procedure stipulated in this Law and other laws. and can be processed in accordance with the principles.
(2) The following principles must be complied with in the processing of personal data: a) Compliance with the law and honesty rules. b) Being accurate
and up-to-date when necessary. c) Processing for
specific, explicit and legitimate purposes. ç) Being connected,
limited and restrained with the purpose for which they are processed.
d) As long as required by the relevant legislation or for the purpose for which they are processed. preservation.
Conditions for the processing of personal
data ARTICLE 5- (1) Personal data cannot be processed without the explicit consent of the person concerned.
(2) In the presence of one of the following conditions, without seeking the explicit consent of the person concerned
It is possible to process personal data:
a) It is clearly stipulated in the laws. b) It is
compulsory for the protection of the life or physical integrity of the person or another person, who is unable to
express his consent due to actual impossibility or whose consent is not legally recognized.
c) Provided that it is directly related to the establishment or performance of a contract, It is necessary to process the personal data of the parties to the contract. ç) It is mandatory
for the data controller to fulfill its legal obligation. d) The person concerned has been made public by himself. e) Data processing is mandatory for the establishment, exercise or protection
of a right. f) Provided that it does not harm the fundamental rights and freedoms of the data subject,
Data processing is mandatory for the legitimate interests of the controller.
Conditions for the processing of sensitive personal data
ARTICLE 6- (1) The race, ethnic origin, political thought, philosophical belief, religion, sect or other belief, disguise and dress, membership of association, foundation or union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are special personal data.
(2) Processing of sensitive personal data without the explicit consent of the person concerned is prohibited.
(3) Personal data other than health and sexual life listed in the first paragraph may be processed without seeking the explicit consent of the person concerned, in cases stipulated by the laws. Personal data related to health and sexual life are only for the purpose of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing, by persons or authorized institutions and organizations under the obligation of secrecy without seeking the explicit consent of the person concerned. can be processed.
(4) In the processing of sensitive personal data, it is also obligatory to take adequate measures determined by the Board.
Deletion, destruction or anonymization of personal data ARTICLE 7- (1) Although it
has been processed in accordance with the provisions of this Law and other relevant laws, personal data is deleted or destroyed by the data controller ex officio or upon the request of the data subject, in case the reasons requiring processing are eliminated. or anonymized.
(2) Regarding the deletion, destruction or anonymization of personal data The provisions of other laws are reserved.
(3) The procedures and principles regarding the deletion, destruction or anonymization of personal data are regulated by a regulation.
Transfer of personal data ARTICLE
8- (1) Personal data cannot be transferred without the explicit consent of the person concerned.
(2) Personal data; a)
In the second paragraph of Article 5, b) In
the case of one of the conditions specified in the third paragraph of Article 6, provided
that adequate measures are taken, without seeking the explicit consent of the person concerned. transferable.
(3) Provisions in other laws regarding the transfer of personal data are reserved.
Transfer of personal data abroad
ARTICLE 9- (1) Personal data cannot be sent abroad without the explicit consent of the person concerned.
(2) Personal data, in the second paragraph of Article 5 and the third paragraph of Article 6 the existence of one of the specified conditions and in the foreign country to which the personal
data will be transferred; a) There is
sufficient protection, b) In the absence of sufficient protection, the data controllers in Turkey and in the relevant foreign country undertake in writing to provide an adequate protection and the Board has the permission,
may be transferred abroad without seeking the explicit consent of the person concerned, provided that the (3) Countries with adequate protection are determined and announced by the Board.
(4) The Board determines whether there is sufficient protection in the foreign country and whether the second paragraph (b) whether it will be allowed pursuant to subparagraph;
a) International conventions to which Turkey is a party, b) The
reciprocity of data transfer between the country requesting personal data and Turkey, c) The nature and processing
of personal data with respect to each concrete personal data transfer purpose and duration,
ç) The relevant legislation and implementation of the country to which the personal data will
be transferred, d) The measures undertaken by the data controller in the country to which the personal data will be
transferred, by evaluating and, if needed, by taking the opinion of the relevant institutions and organizations.
(5) Personal data may be transferred abroad with the permission of the Board, only after obtaining the opinion of the relevant public institution or organization, in cases where the interests of Turkey or the person concerned would be seriously harmed, without prejudice to the provisions of international conventions.
(6) In other laws regarding the transfer of personal data abroad, provisions are reserved.
THIRD PART Rights and Obligations
The obligation to inform the data controller
ARTICLE 10- (1) During the acquisition of personal data, the data controller or the person authorized by him, to the relevant persons; a) The
identity of the data controller and its representative, if any, b)
For what purpose the personal data will be
processed, c) To whom and for what purpose the processed personal data can be transferred, ç) Method and legal reason for collecting
personal data, d) Other rights listed in Article 11,
liable.
Rights of the person concerned
ARTICLE 11- (1) Everyone, by applying to the data controller; a) To learn whether
personal data is processed, b) To request information
if personal data has been processed, c) To learn the purpose of
processing personal data and whether they are used in accordance with its purpose, ç) To know the
third parties
in the country or abroad to whom personal data are transferred, d) Personal data Requesting correction of data in case of incomplete or incorrect processing, e) Deletion or destruction of personal
data
within the framework of the conditions stipulated in Article 7
f) Request notification of the transactions made pursuant to subparagraphs (d) and (e) to third parties to whom personal data has been
transferred, g) By analyzing the processed data exclusively through automated systems objecting to the emergence of a result against the person himself,
ÿ) In case of loss due to unlawful processing of personal data, it has the right to demand the compensation of the damage.
Obligations regarding data security
ARTICLE 12- (1) Data controller; a) To
prevent the unlawful processing of personal data, b) To prevent unlawful access to personal data, c) To ensure the preservation of personal data, in order to ensure the appropriate level of security.
have to take administrative measures.
(2) In case the personal data is processed by another real or legal person on his behalf, the data controller is jointly responsible with these persons for taking the measures specified in the first paragraph.
(3) Data controller, in his own institution or organization, in accordance with the provisions of this Law. It is obliged to make or have the necessary inspections made in order to ensure its implementation.
(4) Data controllers and data processors cannot disclose the personal data they have learned to others in violation of the provisions of this Law and cannot use them for purposes other than processing. This obligation continues even after they leave office. (5) In case the processed
personal data is obtained by others unlawfully, the data controller shall notify the relevant person and the Board as soon as possible. If necessary, the Board may announce this situation on its own website or by any other method it deems appropriate.
CHAPTER FOUR
Application, Complaint and Registry of Data Controllers Application to the
Data Controller ARTICLE 13- (1) The person concerned submits his requests regarding the implementation of this Law to the data controller in writing or by other methods to be determined by the Board.
(2) The data controller concludes the requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Board may be charged.
(3) The data controller accepts the request or rejects it by explaining its reason and notifies the relevant person in writing or electronically. In case the request in the application is accepted, the data controller fulfills its requirements. In case the application is caused by the fault of the data controller, the fee collected is returned to the relevant person.
Board ARTICLE 14- (1) In cases where the application is rejected, the answer given is insufficient or the application is not answered in due time; The person concerned may file a complaint with the Board within thirty days from the date of learning the reply of the data controller and in any case within sixty days from the date of application. (2) Pursuant to Article 13, no appeal can be made before the remedy has
been exhausted.
(3) The right to compensation according to the general provisions of those whose personal rights are violated is reserved.
Procedures and principles of examination upon complaint or ex officio
ARTICLE 15- (1) The Board, upon complaint or in case of learning of the alleged violation. Ex officio, it makes the necessary examination on the matters falling within its scope of duty.
(2) Article 6 of the Law on the Use of the Right to Petition dated 1/11/1984 and numbered 3071 Notifications or complaints that do not meet the conditions specified in the article will not be examined.
(3) Except for information and documents that are in the nature of state secrets; The data controller is obliged to send the information and documents requested by the Board regarding the subject of examination within fifteen days and to enable on- site examination when necessary.
(4) Upon the complaint, the Board examines the request and gives an answer to the relevant parties. Complaint If no response is received within sixty days from the date of the request, the request will be deemed rejected.
(5) In the event that the existence of a violation is understood as a result of the examination made upon the complaint or ex officio, the Board decides that the illegalities it detects will be corrected by the data controller and notifies them to the relevant parties. This decision shall be fulfilled without delay and within thirty days at the latest, following the notification.
(6) If it is determined that the violation is widespread as a result of the examination made upon the complaint or ex officio, the Board takes a principle decision on this issue and publishes this decision. The Board may also take the opinions of relevant institutions and organizations, if it needs it, before taking a decision in principle.
(7) The Board decides to suspend the processing of data or the transfer of data abroad, in case of irreparable or
impossible damage and in clear violation of the law. can give.
Data Controllers Registry
ARTICLE 16- (1) Under the supervision of the Board, the Data are publicly disclosed by the Presidency.
Those responsible are kept in the Register.
(2) Natural and legal persons who process personal data must register with the Data Controllers Registry before starting data processing. However, the Board may make an exception to the obligation to register in the Data Controllers Registry, taking into account the objective criteria to be determined by the Board, such as the nature and number of the processed personal data, the legal origin of the data processing or the transfer to third parties.
(3) Application for registration in the Data Controllers Registry is made with a notification containing the following: a)
Identity
and address information of the data controller and its representative, if any.
b) The purpose for which personal data will be
processed. c) Information about the data subject group and groups and the data categories of these persons. descriptions.
ç) Recipient or recipient groups to whom personal data can be transferred.
d) Personal data intended to be transferred to foreign countries. e)
Measures taken regarding personal data security. f) The
maximum period required for the purpose for which personal data is processed. (4) Changes in the information given pursuant to the third paragraph are promptly
reported to the Presidency.
(5) Other procedures and principles regarding the Data Controllers Registry shall be regulated by regulation.
CHAPTER FIVE
Offenses and Misdemeanors
Crimes
ARTICLE 17- (1) In terms of crimes related to personal data, dated 26/9/2004 and 5237 The provisions of Articles 135 to 140 of the Turkish Penal Code No.
(2) Contrary to the provision of Article 7 of this Law; does not delete personal data or Those who do not make it anonymous are punished according to Article 138 of the Law No. 5237.
misdemeanors
ARTICLE 18- (1) This Law; a) Those
who do not fulfill the obligation of enlightenment stipulated in Article 10 from 5,000 Turkish lira to 100,000 Turkish lira,
b) To fulfill the obligations regarding data security stipulated in Article 12 from 15,000 Turkish liras to 1,000,000 Turkish liras for those who do not bring,
c) Those who do not fulfill the decisions given by the Board in accordance with Article 15 from 25,000 Turkish lira to 1,000,000 Turkish lira,
ç) An administrative fine of 20,000 Turkish lira to 1,000,000 Turkish lira is imposed on those who violate the obligation to register and notify in the Data Controllers Registry stipulated in Article 16.
(2) Administrative fines stipulated in this article are applied to real persons who are data controllers. applicable to private law legal persons.
(3) In the event that the actions listed in the first paragraph are committed within the body of public institutions and organizations and professional organizations in the nature of public institutions, upon the notification to be made by the Board, in accordance with the disciplinary provisions regarding the civil servants and other public officials working in the relevant public institutions and organizations and those working in professional organizations with the quality of public institutions. action is taken and the result is reported to the Board.
CHAPTER SIX
Personal Data Protection Authority and Organization Personal Data Protection Authority
ARTICLE 19- (1) In order to fulfill the duties assigned by this Law, administrative and financial
The Personal Data Protection Authority, which has autonomy and a public legal personality, was established.
(2) The institution is related to the minister to be appointed by the President.1 (3)
The headquarters of the institution is in Ankara.
(4) The Institution consists of the Board and the Presidency. The decision body of the institution is the Board.
Duties of the institution
ARTICLE 20- (1) The duties of the Authority are as
follows: a) To follow the practices and developments in the legislation, in terms of its field of duty,
to make evaluations and suggestions, to carry out research and examinations or to have them made. b) In case of need, public institutions and
To cooperate with organizations, non-governmental organizations, professional organizations or universities. c) To monitor and evaluate international developments regarding personal data,
To cooperate with international organizations on issues falling within the scope of the field, to participate in meetings.
ç) To submit the annual activity report to the Presidency and the Human Rights Investigation Commission
of the Turkish Grand National Assembly (…)2.
d) Fulfilling other duties assigned by law.
Personal Data Protection Board3
ARTICLE 21- (1) The Board independently fulfills and uses its duties and powers given by this Law and other legislation under its own responsibility. No organ, authority, authority or person can give orders, instructions, recommendations or suggestions to the Board regarding the subjects falling within its scope of duty.
(2) The Board consists of nine members. Five members of the Board, the Turkish Grand National Assembly, four Its member is elected by the President (3).
(3) In order to become a member of the Board, the following
conditions are sought: a) To have knowledge and experience in the field of duty of the
Agency. b) To have the qualifications specified in sub-paragraphs (1), (4), (5), (6) and (7) of sub-paragraph
(A) of the first paragraph of article 48 of the Civil Servants Law dated 14/7/1965 and numbered 657. c) Not to be a member of any political
party.
one
With Article 163 of the Decree Law No. 703 dated 2/7/2018, the phrase “with the Prime Minister” in this paragraph was replaced with “with the minister to be appointed by the President”.
2
With Article 163 of the Decree Law No. 703 dated 2/7/2018, the phrase “and to the Prime Ministry” in this paragraph has been repealed.
3
With the article 163 of the Decree Law No. 703 dated 2/7/2018, the phrase “the President with two members and the Council of Ministers with two members” in the second paragraph of this article was changed to “the President
with four members”.
d) To have completed at least four years of higher education at the undergraduate level. d)
(Repealed: 2/7/2018-KHK-703/163 art.)
(4) (Repealed: 2/7/2018-KHK-703/163 art.)
(5) The Turkish Grand National Assembly elects members to the Board by the following procedure: a) For
the election, two times the number of members to be determined in proportion to the number of members of the
political party groups are nominated, and the members of the Board are determined by the number of members per each political party group among these candidates. It is elected by the General Assembly of the Grand National Assembly.
However, political party groups cannot negotiate and decide on whom to vote in the elections to be held in the Turkish Grand National Assembly.
b) The election of the members of the Board is made within ten days after the candidates are determined and announced. For the candidates nominated by political party groups, a combined ballot paper is drawn up as separate lists. Votes are cast by marking the special place opposite the names of the candidates. Votes given more than the number of members to be elected to the Board from the quotas of political party groups determined according to the second paragraph shall be deemed invalid.
c) As many as the number of vacant memberships that received the most votes in the election, provided that there is a quorum for the decision. candidate is selected.
ç) Two months before the end of the term of office of the members; In case of a vacancy in the membership for any reason, elections are held with the same procedure within one month from the date of vacancy or if the Turkish Grand National Assembly is in recess, after the end of the recess. In these elections, the distribution of vacant memberships to political party groups is made by considering the number of members selected from the quota of political party groups in the first election and the current ratio of political party groups.
(6) Forty-five days before the end of the term of office of one of the members elected by the President of the Republic (…)4, or in case the duty ends for any reason, the situation is notified to the Presidency (…)(4) by the Institution within fifteen days. One month before the expiry of the term of office of the members, a new member is elected. If there is a vacancy in these memberships for any reason before the expiry of the term of office, an election is held within fifteen days from the notification. (4)
(7) The Board elects the Chairman and the Deputy Chairman from among its members. Chairman of the Board, He is also the president of the institution.
(8) The term of office of the members of the Board is four years. A member whose term has expired can be re-elected. The person elected to replace the member whose term of office expires for any reason, completes the remaining term of the member for which he was elected.
(9) The elected members, before the First Presidency Board of the Supreme Court of Appeals, said, “I swear on my honor and dignity that I will fulfill my duty in accordance with the Constitution and the laws, with full impartiality, honesty, fairness and justice.” they take an oath. An application for an oath to the Supreme Court is considered a hasty job.
4 WithArticle163oftheDecreeLawNo.703dated2/7/2018,thephrases“ortheCouncilofMinisters” and “or the Prime Ministry to be submitted to the Council of Ministers” were removed from the text of the article.
(10) Unless based on a special law, the members of the Board cannot take on any official or private
duties other than carrying out their official duties in the Board, cannot be a manager in associations,
foundations, cooperatives and similar institutions, engage in trade, engage in self-employment activities, act
as arbitrators and experts. However, the members of the Board may publish for scientific purposes, give
lectures and conferences without hindering their essential duties, and the royalties arising from them may be published. They can get their rights and tuition and conference fees.
(11) Investigations regarding the crimes alleged to have been committed by members due to their duties are carried out in accordance with the Law No. 4483 dated 2/12/1999 on the Trial of Civil Servants and Other Public Officials, and the permission to investigate them is given by the President.5
(12) In the disciplinary investigation and prosecution to be made against the members of the Board, 657 The provisions of Law No.
(13) Board members cannot be dismissed for any reason before their term expires. Board members; a) It is understood later that they
do not meet the requirements for being elected,
finalization of the conviction,
c) It is definitively determined by the medical board report that they cannot fulfill their duties,
it is determined that they do not continue for a total of thirty days,
d) A total of three Boards without permission and excuse within a month, and a total of ten Boards within a year.
it is determined that they did not attend the meeting,
In such cases, their membership ends with the decision of the Board.
(14) Those who are elected as members of the Board are dismissed from their previous duties as
long as they serve in the Board. Provided that they do not lose the conditions for entry to civil service, those who are elected to membership while they are public servants are appointed to a suitable position within one month by the competent authority in case their term of office expires or they apply to their former institutions within thirty days. Until the appointment is made, all kinds of payments they receive are continued to be paid by the Institution. All kinds of payments they receive are continued to be paid by the Institution until they
start any duty or job, and the payment to be made by the Institution to those whose membership is terminated in this way cannot exceed three months. The time they spent in the Institution is deemed to have been spent in their previous institution or organization in terms of their personal and other rights.
5 With Article 163 of the Decree Law No. 703 dated 2/7/2018, the phrase “Prime Minister” in this paragraph was changed to “President”.
Duties and powers of the Board
ARTICLE 22- (1) The duties and powers of the Board are as
follows: a) To ensure that personal data is processed in accordance with fundamental rights and freedoms. b) To decide on the complaints of those who claim that their rights regarding personal data
have been
violated. c) Upon complaint or ex officio, upon learning of the alleged violation, to examine whether
personal data are processed in accordance with the law and to take temporary measures when necessary.
ç) To determine the adequate measures sought for the processing of sensitive personal data. d) To ensure that the Data Controllers Registry is kept. e) Necessary
regulatory affairs regarding the duties of the Board and the functioning of the Agency.
make transactions.
f) To take regulatory action in order to determine the obligations regarding data security. g) To take regulatory action regarding the duties, powers and responsibilities of the data controller and its
representative.
ÿ) To decide on the administrative sanctions stipulated in this Law. h)
Prepared by other institutions and organizations and containing provisions regarding personal data
to give an opinion on draft legislation.
i) The Institution; to decide on the strategic plan, to determine its goals and objectives, service quality
standards and performance criteria. i) To discuss and decide
on the budget proposal prepared in accordance with the strategic plan and objectives and targets of the
Institution. j) Institution’s performance, financial situation, annual activities and matters needed
Approving and publishing draft reports on
k) To discuss and decide on the proposals on the purchase, sale and lease of immovable. l) Fulfilling
other duties
assigned by law.
Working principles of the
Board ARTICLE 23- (1) The Chairman determines the meeting days and agenda of the Board. The President may call the Board for an extraordinary meeting when necessary.
(2) The Board convenes with at least six members, including the chairman, and the total number of members is absolute. decides by majority. Board members cannot vote abstaining.
(3) Board members; They cannot participate in meetings and voting on matters concerning themselves, their relatives by blood up to the third degree and in-laws up to the second degree, their adopted children and their spouses even if the marriage ties between them have been terminated.
(4) The members of the Board cannot disclose the secrets they learn about the relevant persons and third parties during their work to anyone other than the authorities authorized by law, and cannot use them for their own benefit. This obligation continues even after they leave office.
(5) The matters discussed in the Board are recorded in the minutes. Decisions and grounds for dissenting votes, if any, are written within fifteen days at the latest from the date of the decision. The Board announces to the public the decisions it deems necessary.
(6) Unless otherwise agreed, discussions at Board meetings are confidential.
(7) Working procedures and principles of the Board, writing of decisions and other issues are regulated by regulation.
Chairman
ARTICLE 24- (1) The Chairman, in the capacity of the Chairman of the Board and the Institution, is the highest supervisor of the Institution and organizes and executes the Institution’s services in accordance with the legislation, the Institution’s objectives and policies, strategic plan, performance criteria and service quality standards, and ensures coordination between service units.
(2) The President is responsible for the general management and representation of the Institution. This responsibility covers the duties and authorities of arranging, executing, supervising, evaluating the works of the Institution and making it known to the public when necessary.
(3) Duties of the Chairman are as follows:
a) To administer the meetings of the Board.
b) Notification of Board decisions and those deemed necessary by the Board to the public.
publicize and monitor their implementation.
c) To appoint the Vice President, the heads of departments and the Institution personnel. ç) To present the suggestions coming from the service units to the Board by giving their final shape. d) Ensuring the implementation of the strategic plan, in line with service quality standards
to establish human resources and labor policies.
e) To prepare the annual budget and financial statements of the Institution in accordance with the determined strategies, annual goals and targets.
f) In a harmonious, efficient, disciplined and regular manner, the Board and service units To provide coordination for work. g) To carry out the
relations of the institution with other institutions. ÿ) To determine
the area of duty and authority of the personnel authorized to sign on behalf of the President of the Institution. h) To perform other duties related to the management and operation of the Institution.
(4) In the absence of the President of the Institution, the Vice President shall deputize for the President.
The formation and duties of the Presidency
ARTICLE 25- (1) The Presidency; It consists of the Vice President and service units.
The Presidency fulfills the duties listed in the fourth paragraph through service units organized as departments. The number of heads of departments cannot exceed seven.
(2) A President shall be appointed by the President to assist him in his duties relating to the Corporation. Assistant is appointed.
(3) Vice President and heads of departments; at least four years of higher education institution graduates are appointed by the President from among those who have served in the public service for ten years.
(4) The duties of the Presidency are as
follows: a) To keep the Registry of Data
Controllers. b) To carry out the bureau and secretariat operations of the Institution
and the Board. c) In the lawsuits to which the Institution is a party and in execution proceedings,
to represent, to follow or have cases, to carry out legal services.
ç) To carry out the personnel procedures of the members of the Board and those working in the
Institution. d) To perform the duties assigned to the financial services and strategy development units by law. e) Establishing an information system in order to carry out the business and transactions of the Institution, and
ensure its use. f) A report on
the annual activities of the Board or on the matters needed to prepare drafts and submit them to the Board.
g) To prepare the strategic plan of the institution. ÿ) To
determine the personnel policy of the institution, to prepare and implement the career and training plans of the personnel. h) To carry out the
appointment, transfer, discipline, performance, promotion, retirement and similar transactions of the personnel.
ÿ) To
determine the ethical rules to be followed by the personnel and to provide the necessary training.
i) To carry out all kinds of purchasing, rental, maintenance, repair, construction, archive, health, social and similar services required by the Institution within the framework of the Public Financial Management and Control Law No. 5018 dated 10/12/2003.
j) To keep the records of the movable and immovable properties of the
Institution. k) To perform other duties assigned by the Board or the President.
(5) Service units and the working procedures and principles of these units are determined by a regulation put
into effect by the President upon the proposal of the Institution, in accordance with the field of activity, duties and powers specified in this Law.6
Personal Data Protection Specialist and Assistant Specialists ARTICLE
26- (1) Personal Data Protection Specialist and Assistant Personal Data Protection Specialist can be employed in the Institution. Among these, those who are appointed to the Personal Data Protection Expert staff within the framework of additional article 41 of the Law No. 657 are subject to a one-time promotion.
Provisions regarding personnel and personal rights
ARTICLE 27- (1) The personnel of the Institution are subject to the Law No. 657, except for the issues regulated
by this Law.
(2) The payments made within the scope of financial and social rights to the Chairman and members of the Board and to the personnel of the Institution determined in accordance with the additional article 11 of the Decree-Law dated 27/6/1989 and numbered 375 are paid within the framework of the same procedures and principles.
Those who are not subject to tax and other legal deductions from payments made to peer personnel are also not subject to tax and other deductions according to this Law.
6 With the Article 163 of the Decree Law No. 703 dated 2/7/2018, the phrase “Decision of the Council of Ministers” in this paragraph was changed to “By the President”.
(3) The Chairman and members of the Board and the personnel of the Institution are subject to the provisions of subparagraph (c) of the first paragraph of Article 4 of the Social Insurance and General Health Insurance Law No. 5510, dated 31/5/2006. The Chairman and members of the Board and the personnel of the Institution are considered equivalent to the personnel determined as a precedent in terms of retirement rights. Among those appointed to the Chairman and membership of the Board while insured under item (c) of the first paragraph of Article 4 of the Law No. 5510, the terms of service spent in these duties of those whose duties have ended or who wish to leave these duties are taken into account in the determination of their earned rights, salaries, degrees and levels. Among these, the periods spent in these duties of those who fall under the scope of the temporary article 4 of the Law No. 5510 are considered as the period for which office compensation and representation compensation must be paid. In public institutions and organizations, those who are insured within the scope of subparagraph (a) of the first paragraph of Article 4 of the Law No. 5510 and who are appointed as the Chairman and members of the Board, dismissing their relations with the previous institutions and organizations do not require the payment of severance pay or termination indemnity. The service periods for which severance pay or termination indemnity must be paid for those in this situation are combined with the term of service as the Chairman of the Board and the Board membership, and the retirement bonus is considered as the period to be paid.
(4) Public administrations within the scope of central government, social security institutions, local administrations, administrations affiliated to local administrations, unions of local administrations, organizations with revolving funds, funds established by law, institutions with public legal personality, institutions with more than fifty percent of the capital owned by the public, economic state enterprises and state economic institutions and their subsidiaries and institutions, with the consent of other public servants institutions, judges and prosecutors may be temporarily assigned to the Institution with their consent, provided that salaries, allowances, all kinds of raises and compensations and other financial and social rights and aids are paid by their institutions. .
The requests of the institution in this regard are primarily finalized by the relevant institutions and organizations. Personnel assigned in this way are deemed to be on paid leave from their institutions. As long as these personnel are on leave, their civil service and personal rights continue, these periods are also taken into account in their promotion and retirement, and their promotions are made on time without the need for any further action. The time spent in the Institution by those assigned under this article shall be deemed to have been spent in their own institutions. The number of those appointed in this way cannot exceed ten percent of the total number of Personal Data Protection Specialist and Personal Data Protection Assistant Specialist, and the duration of the assignment cannot exceed two years. However, in case of need, this period can be extended in one-year periods.7 (5)
The titles and numbers of the personnel to be employed in the Institution are shown in the attached table (I). Not to exceed the total number of staff, but limited to the staff titles included in the tables attached to the Decree-Law on General Staff and Procedure No. 190 and dated 13/12/1983, making changes in titles and degrees, adding new titles and canceling vacant positions are made by the decision of the Board.
7
With the 119th article of the Law No. 7061 dated 28/11/2017, the phrase “consent of the judges and prosecutors themselves” has been added after the phrase “consent of other public servants institutions” in this paragraph.
CHAPTER SEVEN Miscellaneous Provisions
ARTICLE 28- (1) The provisions of this Law shall not apply in the following cases: a)
Processing of personal data by real persons within the scope of activities related to themselves or family members living in the same residence, provided that they are not given to third parties and that the obligations regarding data security are complied with.
b) Research by anonymizing personal data with official statistics, processing for purposes such as planning and statistics.
c) Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that they do not violate national defense, national security, public security, public order, economic security, privacy of private life or personal rights or constitute a crime.
ç) Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations that have been authorized by law to ensure national defense, national security, public safety, public order or economic security.
d) Regarding the investigation, prosecution, trial or execution of personal data processed by judicial authorities or enforcement authorities.
(2) In accordance with the purpose and basic principles of this Law, Article 10, which regulates the obligation of disclosure of the data controller, Article 11, which regulates the rights of the data subject, with the exception of the right to demand the compensation of the damage, and Article 16, which regulates the obligation to register in the Data Controllers Registry, shall not be applied in the following cases:
a) The processing of personal data is necessary for the prevention of crime or for criminal investigation. b) Processing of
personal data made public by the person concerned. c) Personal data processing required for
the execution of inspection or regulation duties and disciplinary investigation or prosecution by authorized and authorized public institutions and organizations and professional organizations in the nature of public institutions
based on the authority granted by the law. to be.
ç) Regarding the budget, tax and financial issues of personal data processing, necessary for the protection of their economic and financial interests.
Budget and revenues of the Agency
ARTICLE 29- (1) The budget of the Agency is prepared and accepted in accordance with the procedures and principles set forth in the Law No. 5018.
(2) The revenues of the Institution are as
follows: a) Treasury aids to be made from the general budget.
b) Revenues from movable and immovable properties belonging to the Institution.
c) Donations and aids received. ç)
Incomes from the evaluation of their income. d) Other income.
Amended and added provisions
ARTICLE 30- (1) (Related to the Law No. 5018 dated 10/12/2003 and replaced processed.)
(2) to (5) – (Related to the Law No. 5237 dated 26/9/2004 and has been replaced.) (6) (Related to the
Health Services Basic Law No. 3359 dated 7/5/1987 processed instead.)
(7) (Organization of the Ministry of Health and its Affiliates, dated 11/10/2011 and numbered 663 It is related to the Decree-Law on the Law and its Duties.)
regulation
ARTICLE 31- (1) Regulations regarding the implementation of this Law shall be issued by the Authority.
is put into effect.
Transitional provisions
PROVISIONAL ARTICLE 1- (1) Within six months from the date of publication of this Law, Article 21 Members of the Board are elected in accordance with the procedure stipulated in the article and the Presidency organization is formed.
(2) Data controllers, within the period determined and announced by the Board, Responsible Persons must be registered in the Registry.
(3) Personal data processed before the date of publication of this Law shall be brought into compliance with the provisions of this Law within two years from the date of publication. Personal data that are found to be in violation of the provisions of this Law are immediately deleted, destroyed or anonymized.
However, consents obtained in accordance with the law before the publication date of this Law shall be deemed to be in accordance with this Law, unless a declaration of intent is made to the contrary within one year.
(4) The regulations stipulated in this Law shall be put into effect within one year following the publication of this Law.
(5) Within one year from the date of publication of this Law, a senior manager shall be appointed and notified to the Presidency in order to ensure coordination regarding the implementation of this Law in public institutions and organizations.
(6) First elected President, Second President and two members determined by lot for six years; the other five members serve for four years.
(7) Until the budget is allocated to the Institution;
a) The expenses of the Institution are met from the budget of the Prime
Ministry. b) All necessary support services such as buildings, tools, equipment, furnishings and equipment
are provided by the Prime Ministry in order for the Institution to perform its services.
(8) Secretariat services are carried out by the Prime Ministry until the service units of the Agency become
operational.
PROVISIONAL ARTICLE 2- (Annex: 28/11/2017-7061/120 art.)
(1) From political sciences, economics and administrative sciences, economics, law and business faculties that provide at least four-year undergraduate education, from electronics, electrical electronics, electronics and communication, computer, information systems engineering departments of engineering faculties or their equivalence is accepted by the Higher Education Council. from the graduates of higher education institutions in the country and abroad; He was appointed to the cadres of the central organizations of the institutions related to the titles specified in the subparagraph (11) of the paragraph (A) of the section titled “Common Provisions” of the article 36 of the Law No. 657, after a certain period of in-service training and a special proficiency exam, entered with a special competitive exam for the profession. Those who have been in the positions for at least two years excluding unpaid leave periods and those who have been in the positions of faculty members, provided that they have received at least seventy points from the Foreign Language Proficiency Exam and have not attained the age of forty as of the date of appointment, within one year from the date of entry into force of this article. They can be appointed as Data Protection Specialists. The number of those to be appointed in this way cannot exceed fifteen.
Force
ARTICLE 32- (1) This Law; a) 8th, 9th,
11th, 13th, 14th, 15th, 16th, 17th and 18th articles come into force six months after the publication date, b) Other articles come into force on the
date of publication.
LEGISLATION BRINGING ADDITIONALS AND AMENDMENTS TO THE LAW NO 6698 OR PROVISIONS CANCELED BY THE CONSTITUTIONAL COURT
Amending Law/ Decree/Annulment
Constitutional Court Decision Number
7061
Decree/703
Amended or Canceled Articles of Law No. 6698
27, PROVISIONAL ARTICLE 2
19, 20, 21, 25
Effective Date
5/12/2017 together on 24/6/2018
Turkish Grand National
As a result of the parliamentary and presidential elections
On the date when the President took his oath (9/7/2018)
Amending Law/ Decree/Annulment
Constitutional Court Decision Number
7061
Decree/703
Amended or Canceled Articles of Law No. 6698
27, PROVISIONAL ARTICLE 2
19, 20, 21, 25
Effective Date
5/12/2017 together on 24/6/2018
Turkish Grand National
As a result of the parliamentary and presidential elections
On the date when the President took his oath (9/7/2018)