TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
2.3 Collective Redress Mechanisms There is no concept of collective redress for privacy litigation under the Turkish legal system, nor have there been any developments in this area. That said, associations and other legal entities may file lawsuits on behalf of their members or the group of people they represent, to protect their interests, address unlawful situations, or prevent future viola - tions. For instance, under the Turkish Consumer Pro - tection Law consumer organisations, relevant public institutions and the Ministry of Trade may take legal action before the consumer courts to prevent or halt unlawful situations affecting consumers, excluding unfair commercial practices and advertisements. However, these provisions do not explicitly address collective actions related to privacy. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Unlike the EU Data Act, there is no specific regula - tion addressing non-personal data in Türkiye. General rules apply. As for future endeavours, the 12th Development Plan (2024–2028), states that a national data governance framework will be established and the necessary tech - nical, institutional, and legislative infrastructure will be developed. Additionally, the Medium-Term Programme (2026– 2028), sets the development of a governance frame - work that safeguards data privacy and security as a goal, and states that the National Data Strategy and Action Plan will be implemented in the third quarter of 2026. 3.2 Interaction of Data Regulation and Data Protection Since there are no specific standalone data regula - tions, general rules apply.
for moral damages, a causal link between the unlawful attack and the moral damage is required. 2.2 Recent Case Law Due to the lack of transparency (see 2.1 Privacy Liti- gation Overview ), a concrete determination regard - ing the existing case law cannot be made. As such, it is not always possible to determine which privacy lawsuits are currently ongoing or to identify landmark cases. In practice, it is known that legal remedies have been pursued against the decisions and administrative fines imposed by the DPA. However, tracking these cases is not always feasible and, therefore, it would be appropriate to state that no standout cases have been identified. Both ordinary and extraordinary legal remedies have been pursued against the decisions and administra - tive fines imposed by the DPA within the framework of the DP Law, as well as under legislation relating to the right to data protection. For instance, ongoing legal proceedings exist relating to the crime of unlawful recording of personal data under the TCrC, as well as civil proceedings under the TCiC concerning the pre - vention of and/or compensation for unlawful process - ing of personal data as a violation of personal rights. An example, recently issued by the Turkish Supreme Court, is a decision addressing moral compensa - tion claims arising from the unauthorised disclosure of banking records and personal data by a financial institution. The court argued that the bank, acting as a “trust institution” and as the data controller, violated the principles of “purpose limitation” and “data minimi - sation” by submitting extensive account movements that exceeded the specific timeframe requested by the judiciary. It further stated that such an unlawful disclosure constituted a direct violation of the data subject’s personality rights and emphasised that the subsequent publication of this data by third parties did not break the causal link between the bank’s neg - ligence and the resulting moral damage.
519 CHAMBERS.COM
Powered by FlippingBook