Cemre Apaydın
Attorney
The Data Subject Rights Vs. Rights Strictly Bound
Although the definition of the concept of rights strictly bound is not included in the Turkish Legislation, in the Turkish Civil Code ("TMK") numbered 47211, "rights strictly bound"2 are mentioned in article 16 only in one time. The concept of a strict dependent right to person is, as a rule, an absolute right that cannot be used through representative. This right can be exercised only by the rightful owner, and it is not possible to alienate this right to third parties and pass it to their heirs. Although these rights, which are entitled to individual existence, are a subject that should be discussed very broadly, it should be discussed in terms of personal data.
The concept of personal data has a similar definition in the Personal Data Protection Law No. 66983 ("KVKK") and the European Union General Data Protection Regulation4 ("GDPR"), and expresses any information of a specific or identifiable natural person. According to definition, personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected can lead to the identification of a particular person, also constitute personal data.5
In Article 11 of the KVKK, everyone has been given the right to request data about their personal data by applying to the data controller, as well as to the Personal Data Protection Board as a second step in cases where the data controller does not respond within time or if the answer is insufficient ("the Board ") has been granted the right to complain.
The important issue here is whether the right to request information about personal data and to complain to the Board is an absolute right. If these rights are deemed to be strictly dependent on the person, then the person concerned will not only be permitted to request information about personal data related to him and to be used by someone else by proxy. Although there is no clarity in this situation in KVKK and its justification, the Board has decided in which this issue has been passed. A complaint was made to the Board by applicant, who was the heir and spouse of the deceased, in the decision no. 2019/273 of 18.09.20196. Upon requesting the health data of the deceased spouse, but rejecting this request, the applicant applied to the Authority, but it was decided by the Board that there was no action to be taken for this application. The important point in the decision is that it has been suggested that the personality definition should be made in accordance with Article 28 of the TMK and articles 3 and 11 of the KVKK ask for information about the personal data related to deceased, and that no information can be requested about the personal data for the deceased spouse.
With this decision, a debate may arise whether the right to demand personal data is strictly dependent on the individual. Although it is debatable with the lawfulness of the rejection of this request due to the fact that the person is dead in the decision, it should be possible to recognize the real persons' requests for information about personal data with a proxy relationship in accordance with the personality definition. Because even if there is a debate about the fact that personal data is personal rights in terms of the nature of the personal data, it is certain that the right to demand information about personal data is not strictly dependent on the person. In this context, the data subject will be able to exercise this right through another person by giving power of attorney if the data subject wishes to apply to the board.
Even though general attorneys of lawyers are thought to be able to apply on behalf of the person concerned, Article 10 of the Regulation on Personal Health Data7 published by the Ministry of Health is as follows:
"Lawyers cannot request their client's health data with a general power of attorney. The power of attorney issued for the transfer of the health data of his client to the lawyer must contain a special provision indicating the explicit consent of the person concerned regarding the processing and transfer of special personal data."
It is understood that lawyers can request health data with a power of attorney even though there are discussions8 in accordance with the above article of this regulation. Health data are special personal data within the scope of KVKK and should be processed according to personal data and should be treated more precisely. If the principle of "there is little in the majority"9 is set out, it will be possible to request a proxy with personal power of attorney for personal data. From this, it can be concluded that the right to request personal data is not a strict right to the person.
Besides the right to protect personal data is a constitutional right, there are various opinions regarding its nature. Regardless of the nature of the right to protect personal data, regardless of the nature of the right to request personal data, it is not a strict right to a person. This right can be alienable to a third party or lawyer within the framework of the proxy by the data subject. If the right to request personal data is to be made available to a third party within the framework of the proxy relationship, then it will be possible to apply to the Board only via e-mail or cargo. Because, online application via KVK complaint module10 will only be possible through the e-government of the person, and it will not be possible to apply here by proxy. The Personal Data Protection Board also provided information on this subject and the implementation will continue in the future.
Consequently, the right to demand for personal data is not strictly dependent on the person, in accordance with the law and equity pursuant to the civil law, KVKK or the Board's information. There is no legal obstacle to the use of this right by third parties within the scope of the agency.
Footnotes
1. Law published in the Official Gazette No. 24607 dated 22 November 2001
2. höchstper-sönliche Rechte
3. Law published in the Official Gazette No. 29677 of 24 March 2016
4. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
5. https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en
6. https://www.kvkk.gov.tr/Icerik/6710/2019-273
7. Regulation published in the Official Gazette No. 30808 dated 21 June 2019
8.https://www.istanbulbarosu.org.tr/HaberDetay.aspx?ID=14780&Desc=Avukatlar%C4%B1n-Sa%C4%9Fl%C4%B1k-Verilerine-Eri%C5%9Fimini-S%C4%B1n%C4%B1rlayan-Ki%C5%9Fisel-Sa%C4%9Fl%C4%B1k-Verileri-Hakk%C4%B1nda-Y%C3%B6netmelik-D%C3%BCzenlemesinin-%C4%B0ptali-%C4%B0%C3%A7in-%C4%B0stanbul-Barosu-Taraf%C4%B1ndan-Dava-A%C3%A7%C4%B1ld%C4%B1
9. in toto et pars continetur
10. https://sikayet.kvkk.gov.tr/
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.