Newsletter regarding Constitutional Court's Decision on Request for Personal Data Access

The Constitutional Court’s decision dated 28/06/2022 and No: 2018/6161 (“Decision“), published in the Official Gazette dated 20/12/2022, has addressed important issues regarding the right to request protection of personal data as a result of the rejection of the request made by the customer who is the data subject, to the operator company which is the data controller, within the scope of providing information about the telephone line.

Although the Decision is related to a customer’s request made to the operator company, we are of the opinion that the Decision may also be applicable to the employer-employee relationship.

The summary of the Decision and detailed information are provided below.

Summary:

The application is related to the following allegations: the right to request protection of personal data within the scope of right to respect for private life as well as the right to effective remedy (in connection with right to request the protection of personal data) have been violated due to the refusal of the applicant’s request for information about the applicant’s telephone line used by the operating company which is data controller. Constitutional Court accepted the applicant’s claims.

Details:

The applicant requested the following information from A. İletişim Hizmetleri A.Ş. (“the Company“), of which he is a customer: internet data, log records, IMEI information of his phone, and the date he used Hot Spot for the years 2014-2015. The applicant has stated that the Company rejected his request on the grounds that this information was kept in the Company’s records for five years and they would only share this information/data if the court requested it. The applicant claimed that he was unjustly treated and claimed monetary and non-pecuniary compensation.

In its response petition, the Company has stated that the Company had no obligation to share the information requested by the applicant within the framework of the protection of personal data and consumer legislation, and that not sharing the information requested by the applicant did not cause any violation of rights.

The Court dismissed the case on 18/04/2017. In the Court’s decision, it was emphasized that the issues requested to be determined were related to material data rather than a right or legal relationship, and it was stated that the aforementioned data did not constitute the subject of the declaratory action regulated under Article 106 of the Code of Civil Procedure. Upon the applicant’s appeal, the Regional Court of Appeal has dismissed the appeal without prejudice. In the decision, it has been stated that the information requested by the applicant fell outside the minimum information required to be shared pursuant to the legislation.

Subsequently, the applicant has applied to the Constitutional Court with the allegations that the information/data he requested was not provided to him and that his request was rejected by the Consumer Court; therefore, his right to protection of personal data, right to respect for private life, right to legal remedies and right to property were violated.

Conclusion and Decision:

The Constitutional Court drew attention to the following points;

Article 20 of the Constitution states that one of the interests protected under the right to respect for private life is the individual’s right to control information about himself/herself.

In this context, it is stated that everyone has the right to request the protection of their personal data, and this right includes being informed about one’s own personal data, accessing such data, requesting the correction or deletion of such data, and learning whether such data are used for their intended purposes.

Once it is established that personal data exists, any limitation and interference with this data triggers the protections under Article 20 of the Constitution. It was also mentioned that within the scope of the right to request the protection of personal data, the said article provides protection against all kinds of interferences and limitations to personal data, not only against limitations or interferences in the form of processing.

In addition, it was also stated that the principles of openness and transparency are complementary features for the realization of these Constitutional guarantees; in democratic societies, the data processing process should be transparent; data subjects should be given access and necessary measures should be taken to ensure that this opportunity is easily used.

In addition to the above, an ECHR judgment[1] cited in the Decision states that Article 8 of the European Convention on Human Rights was violated when the Ministry of Interior personnel’s request for access to personnel files and evaluations was denied on the grounds that the documents were confidential.

As a result of all these considerations, Constitutional Court has ruled that the right to request protection of personal data within the scope of the right to respect for private life and the right to effective remedy in connection with the right to request protection of personal data were violated in the present case, due to the interpretation preventing the examination of the merits of the applicant’s request for access to his personal data.

In light of this information, we are of the opinion that the issues mentioned in the decision may also be applicable in the event that a similar request is made by the employee to the employer within the scope of an employer-employee relationship. Indeed, the Constitutional Court, in its previous decision dated 12.01.2021 with application number 2018/31036, which was given within the scope of Article 20 of the Constitution, made the following assessment.

“… However, it is understood that the right to request the protection of personal data and the protections regarding the freedom of communication within the scope of the right to respect for private life under Articles 20 and 22 of the Constitution and the Law No. 6698 and the general regulations existing in our legal system are not an obstacle to the application of labor law disputes.”

In addition, the relevant decisions do not set any limitations for data controllers.

You may access the full text of the decision (in Turkish) from the link below:

https://www.resmigazete.gov.tr/eskiler/2022/12/20221220-4.pdf

[1] Yonchev/Bulgaristan, B. No:12504/09, 7/12/2013