Turkey: What Does The DPA's Announcement On COVID-19 Test Results And Vaccination Information Cover?

The Turkish Personal Data Protection Authority (DPA) has published its announcement regarding vaccination information and test result applications within the scope of combating COVID-19. Referring to the letters of the Ministry of the Interior and the Ministry of Labor and Social Security, the DPA evaluated the data processing activities carried out within the scope of the operations of public institutions and organizations authorized by law to constitute an exception for the applicability of the Personal Data Protection Law (DPL).

Recent developments

On 28 September 2021, the DPA published an announcement on the collection and processing of COVID-19 test results and vaccination information. In the announcement, the DPA stated that processing vaccination statuses and COVID-19 test results constitutes an exception to the DPL, provided that the processing is carried out based on and within the scope of the operations of public institutions and organizations authorized by law. You may access the announcement here (in Turkish).

What does the announcement say?

In its assessment, the DPA primarily referred to the letter of the Ministry of the Interior that requires the collection of COVID-19 test results and/or vaccination information to participate in public activities such as concerts or cinemas or using public transport, and to the letter of the Ministry of Labor and Social Security that requires employers to request PCR test results from employees who do not get vaccinated. The DPA further noted that test results, reports and the vaccination status of individuals constitute health data and they must be processed in accordance with Article 6 of the DPL unless there is an exception.

Following these evaluations, the DPA stated that requesting vaccine information or PCR test results should be within the scope of preventive and inclusive activities carried out by public institutions and organizations in accordance with the protection of public health, public security and public order, and to combat COVID-19, by referring to the exception under Article 28/1(ç) of the DPL.

In this respect, under the exception of the DPL, it is permissible to process COVID-19 test results and vaccination information within the scope of preventive and inclusive activities carried out by public institutions and organizations. However, it is stated that processing activities that exceed such scope will not be within the scope of the exception, but will fall under the scope of the DPL.

Conclusion

Pursuant to the announcement of the DPA, processing test results and vaccination information by public and private organizations based on and limited to the letters of the Ministry of the Interior and the Ministry of Labor and Social Security will not be subject to the DPL. However, it is important to note that the relevant data processing activities should not exceed the scope of the ministries' letters. Otherwise, such data processing activity will be considered within the scope of the DPL and will be subject to the conditions for processing health data under the DPL.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.