The embedding of information technology infrastructure in every layer of daily life has markedly heightened individuals’ sensitivity about information belonging to them. Social network applications bring details concerning users’ identities into the view of a wide audience online; this visibility paves the way both for such information to be obtained with ease and for it to be used by malicious persons for unlawful purposes.
In our law, personal data means any information connected with an identified or identifiable natural person. The storage of such information without permission through the internet and information systems, making it available to another person, disseminating it, or obtaining it by unlawful means all fall within the scope of criminal provisions. A person who is subjected to one of these acts has the opportunity to report the matter to the Chief Public Prosecutor’s Office or to law enforcement units.
The processing, obtaining or sharing with third parties of information belonging to an individual without permission is at the same time an interference that injures the privacy of private life, which is under constitutional guarantee. The ability to lead a life befitting human dignity is directly connected with the effective protection of fundamental rights and freedoms. For this reason various provisions have been introduced in the legislation with the aim of preserving the confidentiality of information belonging to the individual. Below we examine the scope of the concept of personal data together with the offences of unlawfully recording, obtaining and disseminating such data.
The Scope of the Concept of Personal Data
Personal Data Protection Act No. 6698 (KVKK) defines personal data as “any information relating to an identified or identifiable natural person”. The definition is a broad one: a person’s forename and surname, place and date of birth, telephone line, vehicle registration plate, and social security and passport numbers are the principal examples that may be counted within this scope. Likewise, curriculum vitae documents, photographs, audio and video recordings, fingerprints, genetic information, IP and electronic mail addresses, the identification details of the devices used, the person’s preferences and the persons with whom they communicate also have the character of personal data. Nor is the scope limited to these; images recorded by cameras operating in areas open to all, information concerning religion and family life, records kept by law enforcement units, and even documents submitted to the case file as evidence in proceedings fall within this category.
The Provisions of the Turkish Penal Code
The protection of personal data is a right recognised at constitutional level. So that this protection should not remain on paper, the involvement of criminal law has been seen as unavoidable; the acts of recording data, transferring it without permission and obtaining it are defined as offences in the chapter of the Turkish Penal Code headed Offences Against Private Life and the Secret Sphere of Life. For a broader framework of the subject, our note entitled Violation of the Privacy of Private Life may be consulted.
Turkish Penal Code No. 5237, Art. 135 — Recording of personal data
“(1) Any person who unlawfully records personal data shall be sentenced to imprisonment from one to three years.
(2) Where the personal data relates to persons’ political, philosophical or religious opinions, their racial origins, or unlawfully to their moral inclinations, sexual lives, states of health or trade union connections, the penalty to be imposed under the first paragraph shall be increased by one half.”
Turkish Penal Code No. 5237, Art. 136 — Unlawfully giving or obtaining data
“(1) Any person who unlawfully gives personal data to another, disseminates it or obtains it shall be punished with imprisonment from two to four years.
(2) (Added: 17/10/2019-7188/Art. 17) Where the subject matter of the offence consists of statements and images recorded pursuant to the fifth and sixth paragraphs of Article 236 of the Code of Criminal Procedure, the penalty to be imposed shall be increased by one fold.”
Turkish Penal Code No. 5237, Art. 137 — Aggravated forms
“(1) Where the offences defined in the preceding articles are committed;
a) by a public official and through the misuse of the authority conferred by their duty,
b) by taking advantage of the facility afforded by a particular profession or trade,
the penalty to be imposed shall be increased by one half.”
The Offence of Recording Data Without Permission
The explanatory memorandum to Art. 135 of the Turkish Penal Code states that any information belonging to a natural person is regarded as personal data. The unlawful storage of such information constitutes the act of recording. It is sufficient in itself that the data has been stored without permission having been obtained from its owner; whether the record is subsequently used does not change the outcome. In other words, even if no harm arises from the act of storage, the mere performance of that act suffices for the article to be applied. The legislature has provided for imprisonment from one to three years for a person who commits this act.
It must be emphasised in particular that, for the offence to be constituted, the recording must have been carried out unlawfully. Speaking of a punishable act for the purposes of Art. 135 of the Turkish Penal Code depends on the absence of any ground of lawfulness rendering the storage of the data legitimate. Such grounds arise where there is “a case provided for by law or the express consent of the person”. Where, for instance, the processing of data is necessary for the establishment, exercise or defence of a right, one may speak of the existence of a ground of lawfulness.
The Transfer of Data to Third Parties, Its Dissemination and Its Obtaining
Social media platforms are foremost among the channels in which personal data circulates most intensively. Indeed, the section of mandatory fields encountered when registering with these platforms requires the user to enter a considerable amount of personal information. Just as with the information given during registration, posts made by the user of their own volition after the account has been opened may also become the subject matter of the offence. To give an example, the storage without the person’s consent of an electronic mail address they have notified of their own accord, or of a photograph they have themselves shared, is punishable under Article 135.
The sanction provided for a perpetrator who gives data to another, disseminates it or obtains it is imprisonment from two to four years.
Circumstances That Aggravate the Penalty
KVKK, which entered into force in 2016, also brought about certain amendments to the Penal Code, and an aggravated form according to the manner of commission of the act was provided for in the second paragraph of Article 135. Accordingly, where the data stored relates to the moral inclinations, sexual life, state of health or trade union connections of the person concerned, the penalty is increased by one half. The same aggravating consequence also arises where the data relates to persons’ political, philosophical or religious opinions or to their racial origins.
Article 137 of the Act, for its part, regulates the aggravated form by reference to the capacity of the perpetrator and to the circumstances facilitating the act:
- Where the offence is committed by taking advantage of the facility afforded by a profession or trade held, the penalty to be imposed on the perpetrator is increased by one half. A nurse who passes on to others, without the patient’s permission, information learned from a patient they have treated may be given as an example of this situation.
- Where the act is carried out by a public official and through the misuse of the authority conferred by their duty, the penalty is likewise increased by one half. A police officer who unlawfully records the data of a person whose statement they have taken and shares it on social channels is the typical addressee of this provision.
Remedies Available to the Victim
Although these acts are among the offences against private life and the secret sphere of life, they are not among the offences whose prosecution is subject to complaint. It is therefore sufficient for the public prosecutor to become aware of the incident for an investigation to be opened of its own motion.
That said, a person who is the victim of one of these offences may report or complain of the matter to the Chief Public Prosecutor’s Office or to law enforcement. The application may be made in writing, and it is equally valid for it to be conveyed orally provided that it is entered in a record. For the procedural details of the subject, our note entitled How Is a Complaint Made in Respect of Cybercrime? may be consulted.
Limitation Periods
In respect of the acts of unlawfully recording, obtaining or sharing data, the limitation period for bringing an action is eight years and the limitation period for the penalty is ten years. Accordingly, notification must be made to the prosecutor’s office, or proceedings commenced of the authorities’ own motion, within eight years at the latest from the day on which the offence was committed; the execution of a finalised penalty must likewise be embarked upon within ten years.
While this is the rule, the aggravated forms alter these periods. If, for example, the act of unlawfully disseminating data has been carried out by a public official through the misuse of the authority conferred by their duty, the limitation period for bringing an action rises to fifteen years. In the same scenario, the limitation period for the penalty in respect of a public official perpetrator has been set at twenty years.
Independent Legal Assessment
What is decisive in criminal investigations concerning personal data is, more often than not, not the existence of the act but the element of unlawfulness. In practice, a significant proportion of files turns on the question whether the data was processed within the scope of express consent or by exceeding the limits of that consent. Moreover, in violations occurring in the digital environment, the fact that evidence rapidly becomes inaccessible makes the steps taken at the outset of the process critical.
In setting a road map in a particular case, it is appropriate to address the following headings first:
- Establishing whether the information in question genuinely has the character of personal data
- Examining whether there is a statutory basis or express consent capable of rendering the processing of the data legitimate
- Characterising correctly which of the forms of recording, giving, disseminating or obtaining the act corresponds to
- Assessing the capacity and professional position of the perpetrator in terms of the aggravated form and the limitation period
- Securing digital evidence such as the content, the IP record and screenshots without delay
- Planning for the administrative application route under KVKK and the criminal investigation to be pursued together
Independent Legal provides advisory and litigation services throughout the entire process in personal data violations occurring in the information technology environment, from preparing the complaint application to following the proceedings.