Turkey: "Legitimate Interests" of the Data Controller as an Exception to the Explicit Consent Requirement Under Turkish Data Protection Law

Law No. 6698 on the Protection of Personal Data ("DP Law"), which came into force on April 7, 2016, requires obtaining a data subject's explicit consent for processing personal data—as a general rule—which is in line with Article 20/3 of the Turkish Constitution. Having said that, the DP Law introduced certain exemptions to this general principle. One such exemption is the processing of personal data for the "legitimate interests" of the data controller. In certain cases, requiring explicit consent for each case may hinder the natural flow of business or the processing of personal data, as the latter may be an inseparable part of the business.

Data Protection Directive 95/46/EC ("Directive")^[1]  also regulates the aforementioned exception and states that certain personal data may be processed without the explicit consent of the data subject where processing is necessary for the purposes of the legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, along with other exceptions to the general principle. Likewise, according to Article 5/2(f) of the DP Law, personal data may be processed without the data subject's explicit consent "if processing is necessary for the purposes of data controller's legitimate interests, provided that data subject's fundamental rights and freedoms are not violated." As data protection legislation is quite new for practitioners in Turkey, application of the aforementioned exception in the EU would be helpful in interpreting the "legitimate interests" exemption.

Article 29 Data Protection Working Party (which is composed of representatives of the national data protection authorities in the EU), adopted an opinion on April 9, 2014^[2],  focusing on the legitimate interests of the controller, and providing guidance on how to apply this exception for processing personal data without the data subject's explicit consent. Article 29 Data Protection Working Party states that a "balance test" should be carried out before relying on this provision and asserts that the elements to consider when carrying out the balancing test should include the following: (i) The nature and source of the legitimate interest and whether the data processing is necessary for the exercise of a fundamental right, is otherwise in the public interest, or benefits from recognition in the community concerned, (ii) the impact on the data subjects and their reasonable expectations about what will happen to their data, as well as the nature of the data and how they are processed, and (iii) additional safeguards which could limit undue impact on the data subject, such as data minimization, privacy-enhancing technologies, increased transparency, general and unconditional right to opt-out, and data portability.

Under DP Law, first of all, the interests of the data controller must be "legitimate" and considered as such by the applicable laws. The data controller's legitimate interests may arise in numerous cases where they are not specifically prohibited by laws. For example, a company may collect job applications and process the personal information contained within CVs to evaluate the job applications, without obtaining the explicit consent of the job applicants. Nevertheless, the data controller may not rely on this exception indefinitely or without limitations. Using the same example, personal information found within CVs should be processed in accordance with the general rules under the DP Law. As per Article 4 of the DP law, personal data must be (i) processed lawfully and fairly, (ii) accurate and where necessary kept up to date, (iii) processed for specified, explicit and legitimate purposes, (iv) relevant, limited and not excessive in relation to the purposes for which they are processed, and (v) kept for only as long as specified by the relevant legislation or is necessary for the purposes of processing. 

Moreover, the data controller may benefit from the legitimate interests exception only if "fundamental rights and freedoms of the data subject are not violated." The fundamental rights and freedoms of individuals are set forth in the Turkish Constitution (along with international treaties), which include but are not limited to the right of privacy.

DP Law requires that fundamental rights and freedoms of the data subject are taken into account and weighed against the legitimate interests of the data controller, but, contrary to the Directive, the provision does not include any reference to the data subject's "interests". Under the Directive, Member States may determine the circumstances in which personal data may be used or disclosed to a third party in the context of the legitimate ordinary business activities of companies and other bodies. Therefore, the DP Law's scope of processing personal data based on legitimate interests without obtaining the data subject's explicit consent is broader than the Directive's. On the other hand, the Directive provides that personal data may be processed for the purposes of the legitimate interests of the data controller or third party or parties to whom the data are disclosed, whereas the DP Law does not refer to the legitimate interests of third parties and the parties to whom data are disclosed.

Finally, the exception explained herein should not be treated as a "last resort" by data controllers and it should not be automatically pursued. For each separate data-processing case, a test should be applied by the data controller to assess the balance between the data controller's legitimate interests and the data subject's fundamental rights and freedoms.

This article was first published in Legal Insights Quarterly by ELIG, Attorneys-at-Law in March 2017. A link to the full Legal Insight Quarterly may be found here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.