Personal Data Protection in International Law and Its Comparison with Turkish Legislation

The protection of personal data has become an indispensable part of the modern legal system in the context of today's international human rights regime and national legislative frameworks. In particular, the confidentiality of private life, which is enshrined in Article 12 of the United Nations Universal Declaration of Human Rights and in Article 17 of the United Nations International Covenant on Civil and Political Rights, forms the normative basis for the protection of personal data. As a result of the transformation triggered by the process of digitalisation that gathered pace in the last quarter of the 20th century, this protection has ceased to be a legal luxury and has emerged as a legal necessity. In this respect, instruments such as the Council of Europe's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the Guidelines of the Organisation for Economic Co-operation and Development, the European Union General Data Protection Regulation (which we shall refer to briefly as the GDPR in this article) and, in Turkish law, Personal Data Protection Law No. 6698 have, in line with international custom and judicial case law, elevated the protection of personal data to a fundamental category of rights guaranteed by positive norms.

Introduction

Personal data is defined broadly, by including every kind of information relating to a natural person, and this approach also reinforces the legitimacy basis of data processing. The general view prevailing in international doctrine determines the minimum conditions for data-processing activities such as collection, recording, storage, alteration, disclosure, transfer and erasure within the framework of the principles of consent, legitimate purpose, proportionality and lawfulness. While the data controller is the primary actor that determines the purposes and means of the processing activity, the data processor is a secondary actor that carries out technical or operational processes under the controller's instructions and supervision. The data subject, in turn, is the subject of this legal relationship, the most important party whose interests must be protected, and at the same time the holder of rights that are guaranteed normatively at national and international level. In Europe, these rights are supported by the case law of the European Court of Human Rights and the Court of Justice of the European Union; thus the autonomy and protection of the data subject are among the indispensable elements that ensure the legitimacy of legal orders.

At the global level, the legal structure concerning the protection of personal data has gained scope and depth through these bodies; the judicial case law they have produced has enriched the meaning of the relevant concepts and defined their boundaries. Thus, the protection of personal data has gone beyond the classical conception of privacy and, particularly in the field of information technology law, has become autonomous and acquired a supranational normative footing. The general approach established in the legal literature is that personal data protection has acquired the character of a human right in the digital age.

The legal regulatory structure concerning the protection of personal data at the international level has a multi-layered, pluralistic and evolutionary character, pointing to a framework that is constantly transforming through supranational normative sources, regional regimes and judicial case law. In this context, the fundamental human rights instruments developed by the United Nations define the minimum values relating to the protection of personal data and serve a universal function, in particular by referring to the confidentiality of private life and the right to privacy. The OECD Guidelines of 1980 on transborder data flows, titled “OECD GUIDELINES FOR THE SECURITY OF INFORMATION SYSTEMS”, took into account the data dimension of globalising economic relations, cross-border trade and digital communication networks and offered a normative framework directing states to ensure the international validity of their data protection legislation. In this process, binding international texts such as the Council of Europe's Convention No. 108 (the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data that I mentioned a moment ago) laid the groundwork for the formation of a normative infrastructure by prescribing certain minimum standards for the contracting states. The fundamental approach arising from this structure has been to introduce a minimum level of protection into national legal systems and thereby to strengthen principles such as lawfulness, proportionality, legitimate purpose and respect for the data subject's fundamental rights in the processing of personal data.

The European Union began its approach to the protection of personal data with the Data Protection Directive of 1995 and then updated it with the directly applicable General Data Protection Regulation (GDPR), creating a functional and advanced normative framework that meets the requirements of modern data. The innovations brought by the GDPR in the field of data protection have had a major impact not only in EU member states but also globally; with rules such as the deterrent effect of administrative sanctions, the recognition of the right to data portability, the obligation to appoint data protection officers and the deepening of the principle of accountability, it has served as a model for other legal systems. The data protection legislation of Brazil, Japan, South Korea and similar countries and, in particular, Personal Data Protection Law No. 6698, which concerns us most, have been inspired directly or indirectly by the GDPR, albeit at different levels and with adaptations to their own legal needs. In this process, the case law of international judicial bodies has not only interpreted the norms on the protection of personal data but has also clarified the scope of the concepts and thereby steered the development of this legal field.

Data Protection Principles in International Law and the Rights of the Data Subject

Data protection regimes in international law have taken shape within a human-rights-based framework founded on the individual's fundamental rights and freedoms, and are structured around a series of principles accepted at the supranational level. These principles aim to strengthen the individual's control over data privacy and to ensure that data-processing activities are carried out lawfully, transparently and proportionately. While these principles constitute the basic building blocks of international law, they have been reinforced, above all by the GDPR and by the case law developed by judicial authorities, and over time have acquired a universal normative character.

• Principle of Lawfulness
  The principle of lawfulness provides that the processing of personal data must be based on a legally valid ground. This principle requires that data processing have a legitimate and explicit basis rather than rest on purely administrative, economic or technological needs. Lawfulness may be based on various legal grounds such as the individual's consent, contractual necessity, legal obligation and public interest. In particular, Article 6 of the GDPR regulates the conditions of lawful processing in detail and provides that data may be processed without consent only in certain statutory situations. In the event of a breach of this principle, the controller's activities are deemed invalid and the controller faces serious administrative sanctions. While lawfulness provides a fundamental safeguard for the protection of individuals' rights over their data, it also defines a clear area of responsibility for those who process data.

• Principle of Transparency
  The principle of transparency guarantees that the data subject is informed about how, for what purpose, by whom and for how long his or her personal data is processed. The obligation to inform is the most important reflection of the principle of transparency and entails the controller's duty to inform the individual, at the time of data collection or during the processing, in clear, comprehensible and easily accessible language. Articles 12-14 of the GDPR detail the duty to provide information through provisions that safeguard transparency. On the basis of this information, data subjects can decide whether or not to consent to the processing of their data and can also exercise their rights effectively. Since failure to apply this principle would leave individuals' data open to arbitrary or abusive use, its breach gives rise to significant sanctions in data protection law.

• Principle of Purpose Limitation
  The principle of purpose limitation requires that personal data be collected only for specified, explicit and legitimate purposes and not be used beyond those purposes. Processing the collected data in later processes for other purposes means a breach of this principle. This principle is expressly regulated in Article 5(1)(b) of the GDPR, which provides that data processing is limited to the specified purposes and that these purposes are clearly notified to the data subject. For example, using data collected by a controller for marketing purposes for profiling without the individual's consent constitutes a violation of this principle. Purpose limitation is an important legal safeguard that protects the individual's autonomy by preventing the arbitrary or abusive use of data-processing activities.

• Principle of Data Minimisation
  The principle of data minimisation means that the data collected must be proportionate to the purpose, adequate and limited. This principle aims to put an end to excessive and unnecessary data collection practices. With the spread of artificial intelligence technologies in particular, the principle of data minimisation has gained greater importance; an excess of personal data has created serious risks for individuals' privacy. While Article 5(1)(c) of the GDPR regulates this principle in detail, it obliges controllers to collect and process only the minimum data necessary for the specified purpose. For example, whereas an e-commerce platform should collect only the data necessary for order processing, the collection of unnecessary additional data constitutes a breach of this principle.

• Principle of Storage Limitation
  The principle of storage limitation provides that personal data be retained for the period necessary for the purpose for which they are processed and be erased or anonymised when that period expires. This principle aims to prevent data from being stored unnecessarily and thereby posing a long-term threat to the individual's privacy. Article 5(1)(e) of the GDPR accepts that data pose a threat to the individual's rights for as long as they are “identifiable” and states that such data must not exceed the necessary period. For example, the continued retention of personal data collected during a job application process after the recruitment process has been completed is contrary to this principle. The limitation of retention periods requires controllers to establish a data destruction policy and thereby prevent data from being kept on a continuing basis.

• Right to Rectification
  The right to rectification grants the data subject the power to request the correction of any deficiency, inaccuracy or outdatedness in his or her processed personal data. Article 16 of the GDPR regulates this right and imposes on the controller an obligation to comply with such requests. Based on the accuracy of personal data, this principle guarantees the correction of false or misleading information about the individual's identity. For example, an address or telephone number recorded incorrectly at a bank must be corrected or updated at the individual's request. This right prevents the individual from being misrepresented, particularly on publicly accessible platforms, and is of great importance for the individual's data security.

• Right to Be Forgotten
  The “right to be forgotten” refers to the right to request the erasure of an individual's personal data when their processing is no longer necessary or when the data are found to have been processed unlawfully. Article 17 of the GDPR elaborates on this right and enables the individual to demand, on justified grounds, that data-processing activities be terminated. The right to be forgotten guarantees that personal data leaving a permanent and irreversible trace, particularly in digital environments, can be removed at the individual's request. This right emerged within the framework of respect for the individual's digital privacy emphasised in the CJEU's “Google Spain” judgment. The judgment held that Google, within the scope of its search engine service, is a data controller responsible for the processing of personal data, and ruled that individuals may request the removal of their personal data from search results where such data are disproportionate, irrelevant or no longer up to date.

• Right to Data Portability
  The right to data portability enables the individual to receive his or her own personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller. This right, regulated by Article 20 of the GDPR, strengthens the competitive structure of the digital market by giving data subjects the freedom to move their data between different service providers. By reducing individuals' dependence, particularly when data pass between platforms, it allows them to make freer choices. For example, an individual can request his or her listening history and playlists from a music service provider and transfer these data to another platform. As one of the cornerstones of the digital economy, this right strengthens the autonomy of data subjects and contributes to improving service quality.

Turkish Law and Personal Data Protection Law No. 6698

For many years Turkish law displayed a normative structure in the field of data protection based on scattered, sectoral and partial regulations; the legal framework for the protection of personal data could only be addressed as scattered across various laws and regulations. In particular, the provision on the confidentiality of private life added to Article 20 of the Constitution with the 2010 constitutional amendment clearly revealed the need for an independent and comprehensive law in this field. As a result of this need, Personal Data Protection Law No. 6698 (KVKK), which entered into force in 2016, became a turning point in the field of data protection in Turkish law; with this regulation, the principles governing the processing, protection and transfer of personal data were defined.

The basic structure of the KVKK was formed by drawing inspiration from the EU's “Directive on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Movement of Such Data” (Directive No. 95/46/EC) and from the norms of the GDPR, and it also constituted an important step within the context of the harmonisation process Türkiye is carrying out with the European Union. By giving concrete form to the universal principles of data protection law such as lawfulness, legitimate purpose, proportionality, data security and explicit consent, the KVKK has placed the legal relationship between data controllers and data subjects on a legitimate footing.

In particular as regards the processing of special categories of personal data, the law provides for stricter rules for the processing of such data and makes conditions such as the requirement of explicit consent and the taking of the necessary technical and administrative measures mandatory. While the obligation to inform expresses data controllers' duty to make their data-processing procedures transparent, the requirement of explicit consent emphasises that the individual must consent to data-processing activities knowingly, of free will and for a specific purpose. The data security obligations of data controllers, in turn, make it mandatory to take the necessary administrative and technical measures to protect the processed personal data from unauthorised access, breach and misuse. In addition, in the event that personal data breaches are detected, the data controller is also under an obligation to notify the Personal Data Protection Board and the persons concerned.

In the enforcement of the KVKK, the Personal Data Protection Authority (KVK Authority) plays a vital role as an independent administrative authority. Through inquiries it initiates ex officio or upon complaint, the Board has the powers and duties to ensure the effective application of the provisions of the KVKK, to guide practice by publishing guidelines and communiqués, and to enhance deterrence by exercising its power to impose administrative sanctions in the face of violations. In this process, by cooperating with international data protection authorities (for example the European Data Protection Board - EDPB, the OECD and the Council of Europe), the Board contributes to the establishment of a global data protection culture in Türkiye.

Secondary legislation giving concrete effect to the KVKK, for example Regulations, Communiqués and Board Decisions, provides legal certainty, particularly in complex data-processing procedures. When we look at the matter, the Board, which publishes guidance documents on subjects such as cross-border data transfer, cloud computing services and artificial intelligence-based data-processing activities, also aims to build a legal structure compatible with technology. Here, however, Türkiye has still not announced a list of safe countries for cross-border data transfers; this has given rise to problems of unpredictability in international data flows. Compared with the GDPR, Türkiye's need for reform in this field was more evident, and mechanisms such as standard contractual clauses and binding rules that would facilitate international data flows needed to be developed. In this context, the Amendments Made to the Personal Data Protection Law by Law No. 7499 brought major innovations to increase harmonisation with the protection of personal data and to resolve the problems encountered in practice. One of the most striking among the amendments was the re-regulation of data-processing activities within the scope of cross-border data transfer. With these amendments Türkiye has accelerated its efforts to put in place arrangements similar to the logic of the GDPR's “safe country” list. It is envisaged that the Board will examine the data protection levels of the relevant countries and announce the countries considered safe. In addition, the amendment elaborated the routes for transferring data abroad, such as the Existence of an Adequacy Decision, Transfer Based on Safeguards, Explicit Consent of the Data Subject, Performance of a Contract, and Public Interest. With these amendments, important steps have been taken towards bringing the KVKK into a structure parallel to the GDPR.

Although these amendments have brought the law closer to international regulations, the prevailing view in the doctrine is that the KVKK should come even closer to GDPR standards, both in its textual content and in its enforcement practices. For example, the fact that certain rights regulated in detail in the GDPR, such as the right to data portability, are included in the KVKK only in a limited manner makes it more difficult for Türkiye to obtain “adequate protection” status in terms of data protection law.

Türkiye's Personal Data Protection Law No. 6698 (KVKK) was prepared with the aim of establishing a framework compatible with international standards; fundamental principles such as lawfulness, proportionality, purpose limitation and data security are at the centre of the protection of personal data in both the KVKK and the GDPR. The obligation to inform imposed on data controllers and the requirement to obtain explicit consent in the processing of personal data are among the provisions in which the KVKK was directly inspired by the GDPR. These provisions aim to increase the individual's control over his or her data and to ensure transparency in data-processing activities.

Moreover, as in the GDPR, the KVKK grants individuals fundamental rights such as the right of access, the right to rectification and the right to erasure, while imposing on data controllers an obligation to take technical and administrative measures. That the KVKK lays down strict rules on the processing of special categories of personal data is another important point of similarity with the GDPR. In addition, the establishment of the Personal Data Protection Authority under the KVKK is based on the model of national supervisory authorities found in the GDPR. All of these examples show that the KVKK has been significantly influenced by international norms and in particular by the GDPR, and that it accordingly aims to create a data protection culture that protects individuals' rights and is founded on accountability and reliability.

However, despite these similarities, some differences still exist in the detailed regulations and enforcement mechanisms. These differences lead to noteworthy consequences in practice, both for the rights of data subjects and for the obligations of data controllers. To give an example: while the right to data portability stands out as one of the innovations introduced by the GDPR, this right is not regulated in the KVKK with the same scope. The right to data portability, regulated in Article 20 of the GDPR, as we mentioned a moment ago, provides the possibility of transmitting data to another controller. In Türkiye, there is no similar provision on the right to data portability; this limits individuals' control over their own data.

Another important difference concerns the obligation to appoint a data protection officer. Under Article 37 of the GDPR, appointing a data protection officer is accepted as an obligation for public authorities, for those carrying out large-scale data-processing activities, or for those managing high-risk data-processing operations. The data protection officer assumes critical responsibilities such as monitoring the lawfulness of data-processing activities, fulfilling requests concerning data subjects' rights and liaising with the relevant regulatory authority. The KVKK contains no such obligation and states only that data security obligations must be fulfilled in this regard. Although this provides flexibility for institutions processing data on a large scale compared with the GDPR, it weakens the accountability obligation of data controllers and prevents the establishment of an effective supervisory mechanism in data protection processes.

The KVKK is also seen to diverge markedly from the GDPR as regards administrative sanctions. The GDPR provides for very heavy administrative fines in the event of a breach of data controllers' obligations. For example, depending on the nature of the infringement, fines of up to 4% of annual worldwide turnover or up to EUR 20 million may be imposed under the GDPR. These sanctions increase the GDPR's deterrent effect and its effectiveness in data protection law. However, the upper limits of the administrative fines provided for under the KVKK remain relatively lower. Although amendments increasing administrative fines were made by Law No. 7499, which I mentioned a moment ago, it is seen that these sanctions do not reach the GDPR level. This results in data controllers' financial liability remaining limited in the event of a breach and, consequently, in weak deterrence in the field of data protection.

Data protection law does not consist solely of rules defined at the legislative level; it has a dynamic and constantly evolving structure. This dynamic structure is given concrete form through judicial case law and the decisions of regulatory authorities, and is updated by being adapted to new technological developments. In particular, the decisions of the Court of Justice of the European Union (CJEU) and the European Court of Human Rights (ECtHR) play a guiding role in the development of international data protection law. Taking the protection of private life under Article 8 of the European Convention on Human Rights as its basis, the ECtHR meticulously examines the effects of data-processing activities on individuals' privacy and emphasises that interference with this right must rest on a legitimate aim, the principle of proportionality and a legal basis. The Court develops case law that protects individuals' privacy by putting the rights of data subjects first, particularly in cases concerning states' large-scale surveillance activities or the data-processing operations of private companies.

Regulatory authorities also perform an important function in the application of data protection law. In the European Union, the European Data Protection Board issues guiding decisions on the application of the GDPR and ensures cooperation among the data protection authorities of the member states. The guidelines published by the European Data Protection Board ensure that data-processing activities are carried out lawfully and provide detailed implementation principles on subjects such as the use of cookies, profiling, artificial intelligence-based automated decision-making processes and the processing of children's data. While these guidelines offer data controllers predictability and guidance in compliance processes, they also lay the groundwork for individuals to exercise their rights more effectively.

In Türkiye, the Personal Data Protection Board (KVK Board), as the most competent authority ensuring the application of the KVKK, supervises the lawfulness of data-processing activities and imposes administrative sanctions on data controllers. Through the decisions it issues as a result of inquiries initiated ex officio or upon complaint, the Board gives concrete form to the principles of legal certainty and foreseeability under the KVKK and at the same time clarifies the obligations of data controllers and data processors. For example, in its decisions on explicit consent, it is emphasised that consent must be based on free will, be specific and be given on an informed basis, and it is expressly stated that explicit consents failing to meet these criteria will be deemed invalid. Similarly, the KVK Board's decisions on data breaches have underscored the importance of the obligation of prompt notification in cases of breach; administrative sanctions have been imposed where data controllers have failed to fulfil their obligations to take technical and administrative measures.

In addition, Board decisions shape practice in areas such as the processing of special categories of personal data, breaches of data security measures and failure to fulfil the obligation to inform, and contribute to the emergence of a case-law mechanism in Turkish law.

Thus, judicial case law and the decisions of regulatory authorities enable data protection law to be transformed from a merely normative field into a structure that adapts to technological developments, effectively protects individuals' rights and strengthens the obligations of data controllers. This process is of great importance for Türkiye's convergence with international standards in its KVKK practices and secures individuals' digital rights on a stronger legal footing.

Conclusion

In conclusion, as the protection of personal data takes on an increasingly complex dimension in the digital reality of our age, the law in this field is evolving into a dynamic, multifaceted and constantly transforming structure that is not confined to purely normative regulation. On the one hand, artificial intelligence and similar technological innovations are creating new, uncertainty-laden risk areas in data collection, processing, storage and transfer that legislation did not foresee, which forces national and international legal orders to develop more flexible, adaptive and forward-looking norms.

From Türkiye's perspective, the KVKK's growing convergence with international standards, particularly the GDPR, is a strategic investment that will strengthen its position within the global data economy. For this, revising legal texts alone is not sufficient. Türkiye's gaining “safe country” status and thereby providing predictability regarding data traffic will help both foreign investors and multinational companies to see Türkiye as a preferable data-processing hub. However, obtaining such a status requires not only legislative changes but also the development of the Authority, the enhancement of practitioners' competence through training activities, the strengthening of civil society's participation in decision-making processes, the encouragement of academia's capacity to produce knowledge and offer policy recommendations, and the improvement of corporate policies by the private sector through investment in data protection. In this process, it is essential that the law develop approaches that take into account the social, economic, cultural and ethical dimensions as much as keeping pace with technical innovations. By taking an active part in this transformation, Türkiye can make its own distinctive contribution to the building of global data protection law, with a strong institutional structure, comprehensive reforms oriented towards implementation, intensive interaction among stakeholders and multidimensional perspectives. In this way, data protection law will become an indispensable part of a sustainable, effective, fair and predictable order that will secure the digital rights of future generations.

Mehmet Emre DARICI, Attorney at Law