This content has been translated from the original text.
In Türkiye, the collection and processing of identity card information for security purposes by various institutions and businesses, particularly in shopping centres, residential complexes and office towers, is a widespread practice. In some places, it is even seen that an identity card is taken from the visitor and an entry card is given in exchange, and that the visitor's signature is also taken in a ledger in which the identity information is recorded. However, it is important to assess this practice, which is carried out unlawfully, from the standpoint of the protection of personal data. In this article, the lawfulness of the processing of Republic of Türkiye identity card data by private security officers at the entrances of residential complexes, residential buildings or office towers will be examined and assessed.
INTRODUCTION
In Türkiye, the collection and processing of identity card information for security purposes by various institutions and businesses, particularly in shopping centres, residential complexes and office towers, is a widespread practice. In some places, it is even seen that an identity card is taken from the visitor and an entry card is given in exchange, and that the visitor's signature is also taken in a ledger in which the identity information is recorded. However, it is important to assess this practice, which is carried out unlawfully, from the standpoint of the protection of personal data. In this article, the lawfulness of the processing of Republic of Türkiye identity card data by private security officers at the entrances of residential complexes, residential buildings or office towers will be examined and assessed.
THE POWER OF PRIVATE SECURITY OFFICERS TO OBTAIN INFORMATION
The Republic of Türkiye identity card is an official document that states the identity of Turkish citizens, and it contains a range of personal information. Among this information are important data such as name, surname, identity number and date of birth. The practice of collecting and recording this identity card information by security officers or other officials at the places of entry is a matter that must be handled with care from the standpoint of the protection of personal data.
The power of private security officers to obtain information is defined in Article 7 of Law No. 5188 on Private Security Services, titled "Powers of private security officers". By the nature of their work, security officers need to find out who the visitor is and the purpose of the visit. However, they do not have the statutory powers to ask for identification, to find out the purpose of the visit or to record vehicle licence plates. Therefore, even if they record this information, such a record has no legal basis. Although security officers do not have the power to take and record people's identity information on entry and exit, in this situation, which is frequently encountered in daily life, a legal complexity arises in which security services and personal data are intertwined.
LAWFULNESS OF THE PROCESSING OF IDENTITY CARD DATA
The concept of personal data is defined in Article 3(d) of Law No. 6698 as "any information relating to an identified or identifiable natural person". The identity or citizenship number that makes a person's identity identifiable is also among personal data. Within the scope of the Personal Data Protection Law No. 6698, a person's Republic of Türkiye Identity Number is not assessed in the category of special categories of personal data, but in the category of personal data of a general nature, within the scope of identity data.
In order for information such as the name and surname of the person taken by private security at office tower entrances, the TR identity number, the information on whom the person has come to see and the licence plate of the vehicle used to be recorded lawfully, it is necessary to act in compliance with Law No. 6698. Personal data can be processed where at least one of the conditions listed in Article 5 of the Law exists.
The general principles listed in Law No. 6698 for the processing of personal data are;
Being in conformity with the law and the rules of good faith,
Being accurate and, where necessary, up to date,
Being processed for specified, explicit and legitimate purposes,
Being relevant, limited and proportionate to the purposes for which they are processed,
Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed
The processing of personal data will be lawful only if these principles are complied with.
The recording of security officers' identity information essentially serves the purpose of ensuring the security of the institutions. However, care must be taken in the protection and processing of the personal data collected in this process. The KVKK aims to prevent the unlawful processing of personal data and unauthorised access to such data.
THE OBLIGATION TO INFORM
Although obtaining the explicit consent of persons is a ground of lawfulness in the processing of personal data, whether the explicit consent of the person needs to be obtained in each concrete case must be assessed by taking into account the laws and the Board's decisions.
The fulfilment of the Obligation to Inform holds an important place for the practices that are the subject of this article. According to Article 5 of the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, the obligation to inform must be fulfilled in every case in which personal data is processed, whether on the basis of the explicit consent of the data subject or on the basis of the other processing conditions in the Law. The Obligation to Inform, regulated in Article 10 of Law No. 6698, is the informing of data subjects by data controllers or the persons they authorise at the time personal data are obtained.
In fulfilling this obligation, the information to be provided by data controllers or the persons they authorise must, as a minimum, include the following matters:
The identity of the data controller and of its representative, if any,
The purposes for which the personal data will be processed,
To whom and for what purposes the personal data may be transferred,
The method and legal basis of the collection of personal data,
The other rights of the data subject listed in Article 11 of the Law.
This information must be provided before the data processing activity begins or, at the latest, when the data processing activity begins.
As is understood from all these explanations, although it is not necessary to obtain explicit consent in the process of processing persons' personal data by security officers at the entrances of residential complexes, residential buildings or office towers, the fulfilment of the obligation to inform, which is among the obligations of the data controller, is mandatory. Otherwise, the penal sanction set out in Article 18(a) of the Law, "a) against those who fail to fulfil the obligation to inform provided for in Article 10, from 5,000 Turkish liras up to 100,000 Turkish liras", may be applied.
PROPORTIONALITY IN THE PROCESSING OF PERSONAL DATA
Article 4 of the Personal Data Protection Law No. 6698 provides that personal data may be processed only in accordance with the procedures and principles stipulated in the Law and in other laws, and thereby sets out the general principles that must be complied with in the processing of personal data. Accordingly, personal data must be processed in a manner that complies with both the conditions for processing set out in the Law and the general principles.
Processing of Personal Data
ARTICLE 4- (1) Personal data may be processed only in accordance with the procedures and principles stipulated in this Law and in other laws.
(2) The following principles must be complied with in the processing of personal data:
a) Being in conformity with the law and the rules of good faith.
b) Being accurate and, where necessary, up to date.
c) Being processed for specified, explicit and legitimate purposes.
ç) Being relevant, limited and proportionate to the purposes for which they are processed.
d) Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.
The purpose of Law No. 6698 is to protect the fundamental rights and freedoms of persons, in particular the privacy of private life. Although the Law does not prohibit the processing of personal data, since it gives priority to the fundamental rights and freedoms of persons, data controllers must process personal data in a manner that interferes least with the fundamental rights and freedoms of the data subjects.
The "principle of being relevant, limited and proportionate to the purposes for which they are processed", one of the general principles regulated in Article 4 of the Law, indicates that the processing of personal data must be to the extent necessary to achieve its purpose. The personal data processing activity must cumulatively satisfy the criteria of being suitable for achieving the intended purpose (suitability), of being necessary in relation to the intended purpose (necessity) and of being proportionate to the intended purpose (proportionality).
In the processing of the T.C. identity number and, in general, identity card information, it is important for data controllers to take into account whether there are methods that interfere less with the data subjects' right to the protection of personal data and, if there are, to prefer these methods, and to take the necessary technical and administrative measures to carry out the personal data processing activity in compliance with the Law. Within the scope of Article 12 of the Law, the data controller is obliged to prevent the unlawful processing of personal data.
In the decision of the Personal Data Protection Board dated 17/08/2023 and numbered 2023/1430;
Following a notification received by the Authority stating that persons' T.C. identity number information was requested when registering to use the mobile application of a data controller providing a meal card service, an ex officio examination of the matter was initiated by the Personal Data Protection Board (the Board). In the examination carried out on the mobile application, it was found that name, surname, telephone number, date of birth and e-mail information were requested when registering to the mobile application, and that when a meal card was to be defined on a person's profile, it was stated that the information entered would be compared with the T.C. identity number.
Since, where physical meal cards are registered in the mobile application, it is possible to carry out the verification of the card by methods that protect the data subjects more, such as processing the card and telephone number information through the employer, without processing persons' T.C. identity number information, it was decided to impose an administrative fine of TL 200,000 on the data controller, which was considered not to have fulfilled its obligations under the first paragraph of Article 12 of the Law.
When assessed within the scope of the article, considering that the purpose that the practice seeks to achieve in making the provision of any card on which the TC identity number is written compulsory at the entrances of residential complexes, residential buildings or office towers can also be achieved by other methods that interfere less with personal data, such as taking a business card instead of an identity card, or contacting the person being visited and confirming the visitor's identity, it is clear that the practice of retaining cards on which personal data are found, such as the TC identity card or driving licence, and giving an entry card in return, is unlawful.
DELETION, DESTRUCTION OR ANONYMISATION OF PERSONAL DATA
Even if personal data have been processed in accordance with Law No. 6698 and the provisions of other relevant laws, where the reasons requiring their processing cease to exist, the personal data must be deleted, destroyed or anonymised by the data controller ex officio or upon the request of the data subject. This matter, regulated in Article 7 of the Law, is among the obligations of the data controller. Personal data must be retained only for as long as necessary.
If the processed personal data are not deleted, destroyed or anonymised even where they have ceased to be necessary, Law No. 6698 will have been violated. Apart from the failure to delete, destroy or anonymise the data constituting a violation of Law No. 6698, the copying and unlawful reproduction of personal data by security officers will also be regarded as an offence under the TPC.
CONCLUSION
Under the Personal Data Protection Law No. 6698, the processing of personal data is considered lawful only when it complies with certain conditions. Among these conditions are that the processing of personal data be in conformity with the law and the rules of good faith, that it be carried out for specified, explicit and legitimate purposes, that the data be relevant, limited and proportionate to the purposes for which they are processed, and that they be retained only for as long as necessary.
The obligation to inform is an important obligation that must be fulfilled by data controllers or authorised persons during the processing of personal data. According to this obligation, in addition to obtaining the explicit consent of the data subjects for the processing of personal data, it is mandatory to provide these persons with the necessary information on how the data will be processed.
The principle of proportionality in the processing of personal data requires the data controller to act in a manner that interferes least with the fundamental rights and freedoms of the data subjects. The decisions of the Personal Data Protection Board reveal important points to be taken into account in practice and remind data controllers of their obligations.
On the other hand, where the reasons requiring the processing of personal data cease to exist, it is mandatory for these data to be deleted, destroyed or anonymised. This matter is among the obligations of the data controller, and in the event of a violation of the law, sanctions will be encountered.
In conclusion, it is clear that the practices of private security officers whom we encounter in our daily lives collecting, retaining and processing identity card data at the entrances of residential complexes, residential buildings or office towers are unlawful in nature. Where, instead of practices carried out in complete contradiction to the principle of proportionality, the simple method of taking people's business cards or merely contact numbers rather than the TC Identity Card is applied, if any problem is encountered, since the person's telephone number can also be reached easily, grievances can be remedied more quickly. By contrast, the taking and retention of important documents such as the TC Identity Card or driving licence, in breach of the principle of proportionality and without even using an information notice, will lead to a breach of information security and therefore constitutes grounds for a complaint to the Personal Data Protection Board. Care must be taken in the processes of protecting and processing personal data, the relevant legislation must be complied with, and the rights of data subjects must be respected. In terms of protecting data, ensuring individuals' privacy and carrying out security services effectively, simply retaining a datum assigned uniquely to everyone, such as the TC identity number, is clearly contrary to law, and changing the practice in question so as to proceed with purely contact data is highly important both for compliance with the law and for the safety of persons.
Trainee Attorney Aleyna Nur Acır
