Turkish Personal Data Protection Law no. 6698 (the “Law”) entered into force on April 7th, 2016 and the Data Protection Authority (the “Authority”) was established at the end of 2016 as an independent authority to fulfil the requirements under the Law. According to the Law, processing the data is defined as any operation which is performed on personal data, whether or not by automatic means, such as collection, recording, retrieving, retaining, and/or transmission, erasure or destruction. The Law regulated that personal data shall not be processed without obtaining the explicit consent of the data subject. However, the circumstances in which the explicit consent is not required for a lawful processing are also regulated in the Article 5 of the Law.
To ease the lawful processing and transferring of data in our rapidly growing e-commerce and tech friendly world, not only the exceptions of obtaining explicit consent but also the cases in which the provisions of the Law shall not be applied regulated in the Law. Pursuant to the Article 28; processing of personal data for the purposes of art, history, and literature or science, or within the scope of freedom of expression, provided that national defense, national security, public safety, public order, economic safety, privacy of personal life or personal rights are not violated is not obligated to fulfill the requirements of the Law.
With the respect of this Article; we may notice that the processing conducted with the purposes of art, history, and literature or science, or within the scope of freedom of expression shall be exempted from the Law. However, there is a precondition to rely on this Article: Non violation of national defense, national security, public safety, public order, economic safety, privacy of personal life or personal rights.
We may notice that, all non violation interests mentioned in the Article 28 eventually have a connection with press and journalism related matters. It must be one of the main priorities of today’s press to be very careful and sensitive about personal data and its effect on privacy right while considering the watchdog function of press[1], which is explained as a liability to transmit information and ideas in subjects of public interest in a democracy by Constitutional Court of Turkey.
The street interviewing, street photographing or publishing these materials on internet is very popular nowadays. Especially, social media based press and photojournalists usually use these kind of material on their platforms. Even though, implied consent is an accepted definition in General Data Protection Regulation (the “GDPR”), there is not any definition refers to implied consent in the Law. Due to the fact that we are not able to accept implied consent, we have to acknowledge that when someone reply your questions while they were being filmed and consenting the filming process by merely their actions is not an acceptable form of consent in terms of the Law.
Considering sudden and spontaneous nature of street interviewing or street photographing activities, obtaining explicit consent before the data processing may always not be possible. However, the Law does not provide any exemption based on the nature of the data activity. Therefore, these data processing taken place without the explicit consent of data subject may likely to constitute violation of the Law.
In terms of the instance, even the purpose of processing is related to art or science or within the scope of freedom of expression data controllers have to take necessary precautions to protect individual’s rights. The first step is obtaining explicit consent from the data subjects. If there is no way to obtain consent, the necessary precaution is to take out any information relating to an identified or identifiable natural person from the photos, news without changing the structure of material by using methods such as blurring the individuals’ photos or changing their voices.
Data controllers have to note that in case of any conflict between data subject and controller, data controller has to prove he fulfilled his obligations as a data controller under the Law. If the data controller does not obtain explicit consent from the data subject and publishes that material on social media as a news without blurring, the data subject may complaint to the Authority and also may issue a criminal complaint according to the Article 135 and 136 of The Turkish Criminal Code that define the act of unlawful record, delivery, and publication of personal data.
