Law Regarding Protection of Personal Data numbered 6698 (“Law”) has entered into force upon its publication in the Official Gazette on 7 April 2016. Afterwards, Regulation on the Processing and Protecting the Privacy of Personal Health Data (“Personal Health Data Regulation”) has been published on the Official Gazette on 20 October 2016 as one of the sub-legislation of the Law and came into force on the same date.

Even though the Personal Health Data Regulation has several provisions in parallel with the Law such as data protection, data transfer, obtaining explicit consent of the data subject; it also contains some contradictions with the various provisions of the Law. In this regard, several groups contained Turkish Employer Pharmacist Union (TEİS) and Turkish Dermatology Association filed actions for cancellation and suspension of provisions of the Personal Health Data Regulation claiming the incompatible obligations and contradictions within the Law and Personal Health Data Regulation.

Pursuant to the Law, one of the duties of the Personal Data Protection Board is to deliver its opinion about the legislation drafted by other institutions or organizations that contain provisions on personal data. As the Personal Health Data Regulation was issued by Ministry of Health (“MoH”) without waiting for the establishment of the Personal Data Protection Board and thereby without consulting the Personal Data Protection Board, the Council of State found the Personal Health Data Regulation contrary to the Law and granted a motion for stay of execution for all provisions of the Personal Health Data Regulation.

In light of these developments, on November 24, 2017, Regulation Regarding Amendments within the Regulation on the Processing and Protecting the Privacy of Personal Health Data (“Amended Personal Health Data Regulation”) is published on the Official Gazette accordingly. Amended Personal Health Data Regulation brings forth the following main changes within the health data in Turkey:

  • The provision within the Personal Health Data Regulation allowing the publishing and transfer of personal health data in order to determine health policies, to calculate health costs, to enhance health services, to be used in scientific activities and statistical studies by anonymizing is removed.
  • Within the amendment in Article 6/1, it is explicitly stated that the data processor shall not express the personal data obtained for the sake of its duty to a third party and shall not use these data except the purpose of processing contrary to the Law.
  • While the Personal Health Data Regulation stated that in case of breach within personal health data, the notification shall be submitted to the MoH, Amended Personal Health Data Regulation specifies that in case of processing of personal health data in illegal ways,  the notification shall be submitted to Personal Data Protection Board.
  • The provisions within Personal Health Data Regulation in relation to the processing of personal health data by person with confidentiality obligation or relevant institutions and organizations and the transfer of personal health data to public institutions and organizations without explicit consent is totally removed. Instead of these provisions, Amended Personal Health Data Regulation includes direct references to the Articles 6, 8 and 9 of the Law within these subjects.
  • The provision determining the archive of the data requested to be deleted within a host system performed by MoH is removed.
  • The provisions in relation to Personal Health Data Commission to be established under the MoH in charge of several duties such as determining MoH policies, delivering opinions, resolving disputes, examining applications for data transfer, analyzing oppositions is totally removed within Amended Personal Health Data Regulation.

Considering the uncertainty in relation to implementation in the Law and its unsettled enforcement currently, we assume that the implementation of Amended Personal Health Data Regulation will be shaped in the upcoming days. Such developments reveal the fact that more time is needed for implementation of Law to be settled.