TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Kübra İslamoğlu Bayer, Simge Yüce and Yiğit Aktimur, YAZICIOGLU Legal
not have complete freedom in their relationship with their employer due to the power imbalance between the parties, nor the ability to withdraw consent without facing negative consequences. Therefore, controllers should carefully assess whether the requirements for explicit consent are met, particularly for processing activities within an employment relationship. That said, this does not mean that explicit con - sent obtained from employees will always be deemed invalid. In a decision involving a con - troller based abroad that obtained employees’ personal data through its liaison office, the DPA clarified that employees’ explicit consent for the transfer of personal data abroad may be con - sidered valid, as the employee understands that their data will ultimately be processed by the controller abroad. Processing Special Categories of Personal Data Before the DP Law Amendments, legal bases for processing special categories of personal data were limited, which posed challenges for con - trollers, particularly employers processing health data in an employment context. However, with the DP Law Amendments, controllers now have more options and may rely on the following legal bases: • explicit consent; • being necessary for the protection of public health, preventive medicine, medical diag - nosis, treatment and care services, and the planning, management, and financing of health services by persons under the obliga - tion of secrecy or by authorised institutions and organisations; • being necessary for the protection of life or physical integrity of a person who cannot express themselves due to an actual impossi -
bility or whose consent is not deemed legally valid or of any other person; • personal data made public by the data sub - ject themselves, provided that it aligns with their intention to make it public; • being necessary for the establishment, exer - cise, or defence of a right; • being necessary for the fulfilment of legal obligations in the fields of employment, occu - pational health and safety, social security, social services, and social assistance; or • being limited to current or former members and affiliates of foundations, associations, or other non-profit organisations or entities established for political, philosophical, reli - gious, or trade union purposes or to persons who are in regular contact with such organi - sations and entities; provided that it: (a) complies with the legislation applicable to these organisations and entities and aligns with their purposes, (b) remains confined to their fields of activity, and (c) is not disclosed to third parties. The DP Law Amendments explicitly introduced the employment relationship as a legal basis for processing special categories of data. While this new framework is expected to ease practical challenges, it may not be an ultimate solution, as controllers may rely on this legal basis in very limited cases. Recently, in February 2025, the DPA published the Guidelines on the Processing of Special Categories of Personal Data, emphasising how these legal bases will be interpreted by the DPA. The guidelines also outline the scope and defi - nitions of special categories of personal data, provide practical real-life examples for applying legal bases to process such data, and specify
487 CHAMBERS.COM
Powered by FlippingBook