The decision of the Personal Data Protection Board ("Board") dated 10.02.2022 and numbered 2022/103 ("Decision") regarding the allegation of sharing the content of the enforcement proceedings file regarding a company in which the name of the data subject is mentioned in the company title, has been published.
Within the scope of the complaint subject to the Decision submitted to the Board, it has been claimed that:
- following the purchase made with the data controller, enforcement proceedings were initiated by the data controller against the spare parts company in which the name of the data subject is mentioned, and a public comment was made by a person in a group open to everyone on Facebook, stating that "Enforcement proceedings have been initiated against the company and the documents regarding the enforcement will be shared in this group",
- although the data subject does not have any commercial relationship with the aforementioned person, the personal rights of the data subject were violated by sharing the personal data in the enforcement file with third parties.
As a result of the Board's investigation on the subject, the Board has stated that:
- in the opinion of the Article 29 Data Protection Working Party, dated 04.06.2007 and numbered 4/2007 which was prepared based on the Data Protection Directive 95/46/EC, it was mentioned that the information about legal persons being related to natural persons should be taken into account in the concrete case,
- whether there is personal data should be evaluated according to the certain criteria (content, purpose and resultcriteria) in cases where the title of legal persons is derived from natural person names,
- the said criteria do not need to be found cumulatively, and the criteria can be considered as alternatives to each other,
- the provisions of the Personal Data Protection Law ("PDPL") shall apply to real persons whose personal data are processed, and to natural and legal persons who process this data fully or partially automatically or non-automatically if it is a part of any data recording system and
- in the specific case, although the name and surname of the data subject is included in the title of the company in the enforcement proceedings, it does not meet the definition of personal data within the scope of PDPL, since the posts and comments made are aimed at the legal person, and do not have an effect on the rights and interests of the natural person, or are not used for the purpose of treating the natural person in a certain way.
Due to the reasons listed above, in the light of the evaluations made by the Board:
- it has been decided that the subject of complaint is not within the scope of PDPL, since the data in question is considered as data belonging to a legal person and not a real person.
You may reach the full Turkish text of the Decision via the link below.
https://kvkk.gov.tr/Icerik/7293/2022-103
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.