Privacy Law: Turkish Personal Data Protection Board Publishes Guideline on The Right to be Forgotten

The Turkish Personal Data Protection Board (“Board”) published in October 2021, a Guideline on The Right to be Forgotten (“Guideline”). In particular, the Guideline focuses on clarifying the use of the right to be forgotten in the framework of the Board’s resolution numbered 2020/481 and dated June 23, 2020 on data subjects’ requests for removal from indexes of results of searches with their names and surnames on search engines (“Resolution”).

The Guideline first explains the historical development of the right to be forgotten both internationally an in Turkey, referencing regulations such as Directive 95/46/EC of the European Parliament, General Data Protection Regulation, and Turkish Personal Data Protection Law no. 6698 (“Law”), as well as legal cases.

Subsequently, the Guideline repeats the main points of the Resolution, such as;

• Data subjects’ applications regarding preventing access to search results related to them for searches on search engines with their name and surname shall be deemed as requests to be removed from indexes,
• Considering that search engines determine the purpose and method of processing for personal data they gather on the internet, search engines shall be regarded as data controllers,
• The activities of search engines shall be regarded as personal data processing,
• Data subjects’ applications for removal from indexes shall first be directed to the search engines, then a complaint shall be made to the Board if rejected or not responded to, in accordance with the relevant provisions of the Law,
• Certain criteria determined by the Board shall be primarily considered for comparing benefits when evaluating such applications.

The Guideline emphasizes that the right to be forgotten is not an absolute right and data subjects may request removal from indexes under certain conditions, for example personal data being wrong, irrelevant, or unproportionate considering the purpose of processing, and that removal from search engine indexes does not mean that the personal data is also removed from the source website.

The Board’s criteria for evaluating requests for removal from search engine indexes established by with the Resolution are as follows:

• The data subject plays an important role in public life
• The data subject being a child
• The accuracy of the content of the information
• Relevance of the information to the data subject’s work life
• Information about the data subject being insulting, humiliating, defamatory
• Information being special categories of personal data
• Currentness of the information
• Information causing prejudice against the data subject
• Information posing a risk to the data subject
• Information being published by the data subject themselves
• The contents consisting of data processed within the scope of journalistic activities
• Information being published in accordance with legal obligations
• Information being relevant to a criminal offense

After listing these criteria, the Guideline explains and details key aspects for evaluating each criterion for individual requests for removal from search engine indexes by data subjects. One interesting suggestion for data subjects in the Guideline regarding the criterion of “Information about the data subject being insulting, humiliating, defamatory”, is that in cases of denial for data subject’s request for removal of content that include insulting or humiliating statements, or hate speech against the data subject, which may constitute a criminal offence, it would be a more correct approach to resolve the applications through courts of law instead of a complaint to the Board in accordance with the Law.

Finally the Guidelines explain the details of the procedures for data subjects’ application to data controller and for complaint to the Board in accordance with the relevant provisions of the Law and Communiqué on Procedures and Principles for Application to Data Controller, and once again emphasizes that criminal and civil litigation processes may also be followed besides these application and complaint processes regulated by the Law, depending on the specific situation of the data subject.

Kortan Berat Gödekoğlu