TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
vating factors such as commission by public officials, multiple offenders, or organised groups. 1.9 Enforcement Trends The DPA has focused on specific topics and issued important decisions and announcements regarding its actions. Loyalty Programmes and In-Store Consent Practices The DPA emphasises the importance of authentica - tion mechanisms in loyalty programmes, requiring controllers to verify whether the person using the loy - alty account during a purchase is the account holder. Additionally, the DPA emphasises that SMS verifica - tion codes used during purchases or service process - es must not be misleadingly presented as mandatory if they also serve purposes such as obtaining consent for data processing or commercial communications. Online Protection of Minors The DPA has initiated an ex officio investigation into several social media platforms to examine how chil - dren’s personal data are processed and what safe - guards are implemented. The investigation aims to assess whether adequate measures are in place to protect children from potential risks in the digital envi - ronment, considering the best interests of the child and the need to ensure protection of their personal data when using social media services. Focus on AI Although it has not yet resulted in an enforcement action, the DPA has issued several guidelines regard - ing the use of AI.
courts, hindering the ability to identify clear trends in privacy litigation at this stage. In recent years, the court has rendered a limited num - ber of decisions directly concerning personal data, primarily focusing on the exercise of the rights to dele - tion and rectification, as well as the overall effective protection of data privacy. A notable decision by the court addressed the protec - tion of personal data within the context of inaccurate judicial records. In this case, the court held that the refusal to delete a citizen’s status as a “complainee” from the National Judiciary Network Information Sys - tem, despite the formal absence of an actual com - plaint, constituted a violation of the right to request the rectification of personal data. The court further emphasised that the failure of judicial authorities to conduct a substantive review of the rectification request effectively deprived the individual of an effec - tive legal remedy. Another significant ruling by the Constitutional Court clarified the State’s positive obligations regarding the ineffective investigation of unlawful personal data acquisition and use between private individuals. The court ruled that a superior’s use of a subordinate’s personal records – such as union membership forms and internal petitions – as evidence in a private lawsuit violated the right to data protection. This was con - firmed by the fact that the institution holding the data had never transferred it to the judiciary, and therefore the data was obtained without administrative action or explicit consent. The DP Law refrains from establishing specific pro - visions for the compensation of damages arising from the unlawful processing of personal data and makes no distinction between material and moral harm. Instead, it stipulates that the right to compen - sation for those whose personality rights are violated is reserved under general provisions, while the TCiC explicitly allows for both material and moral claims in such instances. To seek damages based on a viola - tion of the DP Law, the absence of legal justification, a breach of the data controller’s duty of care, and a clear causal link between the unlawful act and the resulting harm must be established. Regarding compensation
2. Privacy Litigation 2.1 Privacy Litigation Overview
Tracking privacy litigation trends in Türkiye is chal - lenging, due to the limited accessibility of case law. Only Constitutional Court decisions are required to be published in the Official Gazette, while decisions from other courts remain largely unpublished. This lack of transparency makes it challenging to predict how data protection laws will be interpreted and applied by the
518 CHAMBERS.COM
Powered by FlippingBook