Turkey: Privacy Protection

Turkey's Constitutional Court examines whether administrative fines imposed for processing publicly disclosed personal data violate the principle of legality in crimes and punishments. The case centers on whether regulatory interpretations can create obligations not explicitly defined in the Personal Data Protection Law, raising fundamental questions about legal predictability and constitutional safeguards in data protection enforcement.

The Turkish Personal Data Protection Board has issued a landmark principle decision addressing the processing of biometric data for employee attendance tracking purposes. This decision establishes critical guidelines for employers regarding the lawful collection and use of sensitive biometric information in workplace settings. Understanding these new regulatory requirements is essential for organizations operating in Turkey to ensure compliance with data protection obligations.

The Turkish Constitutional Court has ruled that the Personal Data Protection Board violated the principle of legality by imposing an administrative fine on an insurance company without proper legal basis for its interpretation of 'disclosure purpose.' This landmark decision requires companies processing data from public sources to reassess their timelines, inventories, and ongoing investigation files under Article 5 of the Personal Data Protection Law.