Türk Ceza Kanunu'nda Kişisel Verilerin Korunması

AN ASSESSMENT OF THE PROVISIONS OF THE TURKISH CRIMINAL CODE

The first national statute in the world on the protection of personal data entered into force in Sweden in 1973 under the name "Data Protection Act"; the first regulation below the national level had been enacted in 1971 in the German Land of Hesse as a "Personal Data Protection Act". Against this background, and considering the time that had since elapsed, the absence of any special legislation in Türkiye (as at the date the article was written) is assessed as a matter calling for criticism.

Considering, further, the development of internet technology and the speed of communication, the problem of protecting personal data has ceased to be merely national and has acquired an international dimension; and since the capture of personal data produces political and economic consequences beyond the harm done to the person as an individual (violation of privacy and the like), it was thought necessary to assess the criminal-law institutions on personal data protection as a whole — the purpose for which the article was written.

The article examines Articles 135 et seq. of the Turkish Criminal Code.

Article 135 consists of two paragraphs. The first criminalises the unlawful recording of personal data; the second criminalises the recording, as personal data, of information on persons' political, philosophical or religious opinions or racial origins, or — unlawfully — on their moral inclinations, sexual lives, states of health or trade-union connections. The article discusses why, once the recording of personal data is criminalised generally in the first paragraph, the special regulation in the second was needed.

Article 136 sanctions the unlawful transfer, dissemination or capture of personal data. Article 137 sets out the aggravated forms of the offences against private life and the secret sphere of life regulated in Articles 132–136. Here the failure to make organised commission an aggravating element is criticised.

It is explained that in Article 136, while the text speaks of personal data, the heading uses only the concept "data" — an error, since "data" and "personal data" bear different meanings. The heading of Article 136 should therefore be brought into harmony with the text.

The third offence in the Code concerning personal data is the failure to destroy them. Article 138 criminalises the failure of those charged with destroying personal data within the system to perform that duty although the statutory period has expired. The use of "data" rather than "personal data" both in the heading ("Failure to Destroy Data") and in the text is criticised. The article emphasises that the recording and use of personal data may be accepted as legitimate under certain conditions, since they serve particular individual and social needs; but such records can be neither unlimited nor kept indefinitely. The expression "the periods prescribed by the laws…" is also criticised: the period after which deletion is required may perfectly well be found not in a statute but in a regulation or similar instrument issued on the basis of one.

The absence, under the legislation then in force, of any sanction applicable where data lawfully recorded are later used outside their purpose is likewise criticised, and the need for statutory regulation on the point emphasised.

The article also criticises the absence from the Code of a special provision covering the case where the offender destroys personal data without capturing them or passing them to others, and argues that this should be regulated independently of Article 244.

The article explains that Articles 135, 136 and 138 should be merged into a single provision, with the sanction graded according to the gravity of the act. Under the existing scheme, recording — which is graver than capture and constitutes the stage after it — carries a lighter penalty than capture, when it ought to carry a heavier one; this inversion is criticised. It is further argued that the personal data specified in Article 135(2) should be recast as an aggravated form entailing an increase of penalty, and that the single provision to be drafted should be placed not in the present chapter but in the chapter on "offences in the field of informatics".

Assessing the national and international regulations together, the article concludes that everyone has the right to demand measures protecting their moral personality in respect of their personal data, and a right of choice as to who may hold their data, for what purposes, and to whom they may be disclosed. While emphasising the necessity of a special statute, the article also notes that general provisions — the Constitution included — do not suffice to solve the problem.

In its assessments the article draws on the doctrine and gives examples from the practice of the European Court of Human Rights and of the Court of Cassation.