- Introduction
With the increasing use of electric vehicles, charging services have evolved from being justrc a service involving the transfer of electrical energy to vehicles; they have transformed into a digital ecosystem integrated with mobile applications, digital membership systems, payment infrastructures, location services, remote access, customer loyalty programs, and roaming applications between different charging network operators. This transformation entails the collection and processing of significant amounts of user data during the provision of charging services.
Within the scope of the charging service, the following data may be processed: first and last name, phone number, email address, membership information, payment and billing information, vehicle information, dates and times of charging transactions, information on the station and socket used, the amount of energy charged, transaction history, IP address, device information, and, in some cases, location data. Even if some of this data is not sufficient on its own to identify an individual, when linked with other data, it may become related to a specific or identifiable natural person. Under the Personal Data Protection Law No. 6698 (“Law”), what is decisive is not so much the nature of the data but whether it can be linked to a specific or identifiable natural person.
Consequently, data processing activities in electric vehicle charging services must be evaluated not only considering energy market regulations but also in accordance with the general provisions of the Law regarding the processing of personal data.
- Legal Framework for Data Processing Activities in Charging Services
The primary regulation governing electric vehicle charging services in Turkey is the Charging Service Regulation (“Regulation”), issued pursuant to the Electricity Market Law No. 6446. The Regulation sets forth the procedures and principles regarding the establishment and operation of charging units and stations, the operation of mobile charging stations, the creation of the charging network, the licensing and regulation of charging network operators’ activities, the rights and obligations of charging network operators, charging station operators, and users, as well as the establishment and operation of the open access platform.
One of the Regulation’s significant implications regarding data is that it imposes obligations on charging network operators to collect, store, and transmit certain data to the Energy Market Regulation Authority (“EMRA”). Under the Regulation, data collected as part of charging services must be securely stored for at least five years from the date the service was provided. Furthermore, EMRA has the right to use, report on, publish, and make publicly available the data it collects from charging network operators.
However, the fact that retaining certain data is mandatory under energy market legislation does not mean that such data can automatically be processed without limitation under the Law. On the contrary, the same data processing activity must comply with both sector-specific legislation and the Law.
EMRA also states that charging network operators must process user data in accordance with relevant legislation, particularly the Law; it requires that the confidentiality, accuracy, and security of user data be ensured and that such data be protected against unauthorized access, disclosure, alteration, and misuse. Therefore, the fundamental issue for charging network operators is to evaluate the following questions separately: “what data is collected,” “for what purpose it is collected,” “on what legal basis it is collected,” “how long it is retained,” and “with whom it is shared”.
- The Nature of Data Processed in Charging Services as Personal Data
A significant portion of the data processed in charging services may qualify as personal data under the Law. For example, information regarding the date, station, and vehicle used for a charging transaction linked to a membership account constitutes personal data if it can be associated with the user’s account.
It is particularly important to record the charging transaction along with information regarding the station and time. While a single charging transaction may seem to provide only limited information about an individual, maintaining a record of regular charging history makes it possible to draw inferences about the person’s movement and usage habits.
With regard to location data, the application of the Law requires a more cautious approach. Article 3 of the Law defines personal data as “any information relating to an identified or identifiable natural person”. Within this framework, location data that can be linked to a specific or identifiable natural person is also considered personal data. Indeed, in its statement regarding the processing of location data, the Personal Data Protection Authority has explicitly stated that location data that makes natural persons identifiable constitutes personal data under the Law.
When data such as a person regularly charging their vehicle at a specific station; the station’s proximity to their residence, workplace, or another regular route; and the systematic recording of charging times are combined, it may be possible to draw highly detailed conclusions about the person’s lifestyle habits.
This matter is also closely related to the Personal Data Protection Board’s (“Board”) decision No. 2021/1303 dated December 23, 2021, regarding car rental systems. The Board has assessed that tracking the location data of vehicles could lead to the identification of a person’s workplace, place of residence, and other locations they visit, and consequently, to the creation of a profile regarding their lifestyle habits. The Board has emphasized that, due to this nature of location data, its processing should constitute an exceptional application.
This approach is also significant in the context of electric vehicle charging services. Continuous location tracking by a charging network operator that is not necessary for the provision of the service should not be evaluated in the same way as the processing of only the charging station’s location or the technical location data required during a specific transaction.
- Legal Basis and Explicit Consent
Pursuant to Article 5 of the Law, the processing of personal data is generally subject to the data subject’s explicit consent; however, explicit consent is not required if other legal grounds listed in the Law are present. These include cases where processing is explicitly provided for by law; is necessary for the conclusion or performance of a contract; is required to fulfill a legal obligation; is necessary to establish or protect a right; or is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the data subject’s fundamental rights and freedoms.
With regard to charging services, three legal grounds are particularly prominent:
- First, if a membership or service contract has been established between the user and the charging network operator, Article 5/2-c of the Law may be invoked regarding the processing of data necessary for the conclusion or performance of the contract. For example, the processing of data necessary to create the user’s account, initiate the charging process, calculate the energy consumed, and collect the service fee may be evaluated under this legal basis, depending on the specific circumstances of the case.
- Second, with regard to obligations related to data retention, reporting, and data transfer to the EMRA arising from the Regulation and other relevant legislation, the legal basis of “compliance with a legal obligation” may apply. However, even in this case, the processed data must not exceed the scope of the relevant legal obligation.
- Third, it may be possible to process certain data based on the legal ground of legitimate interest for purposes such as preventing fraud, ensuring information security, or safeguarding the security of the service infrastructure. However, according to the Board’s approach, an assessment of legitimate interest does not automatically lead to a conclusion; it requires striking a concrete balance between the data controller’s interest and the fundamental rights and freedoms of the data subject.
For this reason, it would also not be legally appropriate for charging network operators to adopt a uniform approach of “processing all data based on explicit consent”. This is because making the service contingent on explicit consent in situations where it is not required, turning explicit consent into a prerequisite for the service, and combining different purposes into a single consent statement can also create legal issues.
- Charging History, Location Data, and Profiling
One of the most significant risks in terms of the Law that are associated with electric vehicle charging systems is the long-term and systematic analysis of charging history. For example, consider a system that stores a user’s charging records from the past two years, including station location, date, time, energy consumption, vehicle model, and payment information. Such a dataset reveals not only that “a charging service was provided” but also the user’s mobility and consumption habits during specific time periods.
If such data is used for customer segmentation, personalized pricing, ad targeting, or behavioral analysis, the data processing activity may deviate from the original purpose of the charging service. The principles set forth in Article 4 of the Law, compliance with the law and the rules of good faith; processing for specific, explicit, and legitimate purposes; and ensuring that the data is processed in a manner that is relevant, limited, and proportionate to the purpose, will be decisive in this regard.
The Board’s decision dated December 23, 2021, and numbered 2021/1303, also serves as a guide regarding profiling. The Board has stated that making assessments and predictions about individuals through automated data processing may constitute profiling; furthermore, it has emphasized that automated decision-making mechanisms in such systems that could result in adverse consequences for the data subject must be evaluated separately.
In this context, if a charging service provider uses systems that produce automated outcomes, such as classifying a specific user as a “high-risk customer” to restrict their access to the service or apply different pricing, it will not be sufficient to rely solely on a general privacy policy. The purpose of the processing, its legal basis, the criteria used, and the data subject’s rights under the Law must be separately evaluated.
- The Concepts of Data Controller and Data Processor
Determining the roles of the data controller and data processor in charging services is of particular importance due to the complexity of the technical infrastructure.
A charging network operator, mobile app provider, payment institution, cloud service provider, charging station operator, and another charging network operator providing services under a roaming agreement may all be part of the same data processing ecosystem. From the perspective of the Law, what is decisive is not the roles the parties assign to themselves in contracts, but rather who actually determines the purposes and means of data processing. The Board’s decision dated December 23, 2021, and numbered 2021/1303 clearly sets forth this point. The Board stated that only being a technical service provider does not automatically confer the status of a data processor; rather, it is necessary to concretely examine who holds the authority to decide on the purposes and fundamental means of data processing. It also acknowledged that joint data controller status may arise in certain circumstances.
This approach is particularly important in the context of roaming systems. The Regulation defines joint roaming agreements as contracts entered into by different charging network operators to provide direct services to each other’s users, which also encompass the exchange of data and payments. Therefore, it must be clearly determined which user-related data is transferred to the counterpart charging network operator within the scope of roaming, the purpose of the transfer, the legal basis for it, how long the data is retained, and with which party the data subject can exercise their rights.
In its decision dated December 23, 2021, and numbered 2021/1303, the Board emphasized that making personal data accessible to other organizations should not be viewed merely as a technical data transfer; rather, the transfer must also be based on a lawful ground within the framework of Article 8 of the Law.
- Information Obligation and Transparency
One of the key elements of compliance with the Law in charging services is the obligation to provide information. It is not sufficient to provide users with only a general notice stating, “your personal data is being processed”. The categories of data being processed, the purposes of processing, the legal grounds, the individuals or groups to whom the data may be transferred, and the rights of the data subject must be clearly and comprehensibly disclosed.
The Board’s decision dated January 27, 2020, and numbered 2020/65, regarding a mobile application providing transportation services, is noteworthy in this regard. The Board determined that the failure to sufficiently explain the data processing activity related to user rating within the application’s privacy notice and terms of use violated the fundamental principles set forth in Article 4 of the Law and the obligation to provide information under Article 10.
This approach can also be considered applicable to charging applications. For example, if an application uses a user’s charging history not only for the purpose of providing the service but also for behavioral analysis or creating personalized campaigns, these purposes must be clearly disclosed to the user.
Furthermore, if different legal grounds exist for different purposes, distinguishing between them, particularly in cases where explicit consent is obtained, will ensure that consent is specific to a particular matter and based on free will.
- Data Security, Retention Period, and Destruction
Since charging services rely heavily on digital infrastructure, they entail significant risks regarding data security. The presence of mobile app accounts, payment information, vehicle identifiers, station usage records, and location data within the same ecosystem could result in a significant amount of data being exposed all at once in the event of unauthorized access or a cyberattack.
Pursuant to Article 12 of the Law, the data controller is obligated to take the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of and access to personal data and to ensure the protection of such data.
The Regulation also sets forth specific obligations regarding data security within the scope of charging services. Pursuant to Article 18 of the Regulation, charging network operators are required to take the necessary measures to ensure the confidentiality, integrity, availability, accuracy, and security of data collected as part of the charging service. Under the second paragraph of the same article, the software systems used to provide the charging service, the charging devices, and the IT infrastructure related to remote access processes must comply with the current version of the TS ISO/IEC 27001 standard; Security measures such as preventing unauthorized access, using secure communication channels, and implementing identity verification and access authorization must be applied, and if cloud computing services are utilized, the necessary security precautions related to such services must be taken.
An important distinction must be made here: the five-year retention obligation stipulated by the Regulation for certain types of data does not mean that all types of personal data may be retained for five years without exception. The five-year period must be evaluated in the context of data falling under the relevant sector-specific obligation. For data outside this scope, the provisions of the Law regarding the principles of purpose limitation, data minimization, and proportionality, as well as the requirements to delete, destroy, or anonymize data once the retention purpose no longer exists, must be taken into account.
- Conclusion
The processing of user data at electric vehicle charging stations is a multi-layered issue situated at the intersection of sector-specific legislation regarding the energy market and data protection law. While it is inevitable for charging network operators to process data in order to provide services to users, this does not grant them unlimited authority to collect and use data.
In particular, each data category, including user accounts, payment information, charging history, vehicle information, and location data, must be evaluated separately; the purpose of processing must be determined, and the appropriate legal basis under the Law must be identified. In this regard, it is crucial to distinguish between data that is essential for the provision of charging services and data used for marketing, profiling, analysis, or personalized services.
Furthermore, with the development of roaming and the platform economy, the roles of data controller, data processor, and, when necessary, joint data controller will need to be determined based on specific data flows. The Board’s assessments regarding car rental systems and location data provide an important benchmark for similar data processing models that may emerge in the electric vehicle charging ecosystem.
In conclusion, for charging network operators, compliance with the Law should not be viewed as preparing a privacy notice. The creation of a data inventory, the determination of processing purposes and legal grounds, the mapping of data flows, the regulation of roaming and service provider agreements from a data protection perspective, the limitation of access rights, the establishment of retention and destruction policies, and, where necessary, the conduct of a data protection impact assessment should all be addressed as elements of a comprehensive compliance program.
With the growth of the electric vehicle charging sector, it is clear that the application of the Law will gain even greater importance, particularly with regard to location data, behavioral analysis, automated decision-making, data transfer via roaming, and payment data. For this reason, it is crucial for industry stakeholders to ensure compliance not only with energy market regulations but also with the fundamental principles of personal data protection from the design phase onward.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
