KVKK Clarification Text
WHAT IS PERSONAL DATA?
Personal data is defined in the Law No. 6698 on the Protection of Personal Data. Personal data refers to any information relating to an identified or identifiable natural person. According to the Law, the 3 basic elements that the concept of personal data should have are as follows:
Belonging to a natural person
Making a person specific or identifiable
Contain all kinds of information
It is obvious that the scope of personal data is very broad. However, to give a few examples:
Identity information
Contact info
Address information
Hobby
Letter
Job application forms
Interview minutes
Customer complaint form
Resumes
Credit and debit card statements
Fingerprint
Examples such as health information etc. can be further multiplied.
WHAT IS THE PROCESSING OF PERSONAL DATA?
Processing of personal data refers to all kinds of operations performed on personal data such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system. Data controllers who process personal data have certain obligations under this law. The most important of these obligations is to inform the natural person whose data is processed and to obtain his/her informed consent.
WHAT IS THE OBLIGATION TO INFORM?
The obligation to inform consists of informing the data subject on a certain subject. Fulfillment of the obligation to inform does not depend on the consent of the data subject.
The Law grants the data subjects whose personal data are processed the right to obtain information on by whom, for what purposes and for what legal reasons such data may be processed, and to whom and for what purposes they may be transferred, and addresses these issues within the scope of the data controller’s obligation to inform. Accordingly, the data controller is obliged to provide the following information to the data subject during the acquisition of personal data within the framework of Article 10 of the Law, either personally or through the person authorized by the data controller:
The identity of the data controller and its representative, if any,
The purpose for which personal data will be processed,
To whom and for what purpose personal data may be transferred,
The method and legal grounds for collecting personal data,
other rights listed in the article.
The data controller’s obligation to inform the data subject continues in cases where the data processing activity depends on the explicit consent of the data subject or where the activity is carried out under another condition in the Law. In other words, the data subject must be informed in every case where his/her personal data is processed.
WHAT IS KVKK CLARIFICATION TEXT?
Pursuant to the LPPD, data controllers are obliged to inform the data subjects whose personal data they process. While the obligation to inform is an obligation for data controllers, it is also recognized as a right for natural persons whose personal data is processed.
The KVKK disclosure text should at least include; the identity of the data controller and its representative, if any, the purpose for which personal data will be processed, to whom and for what purpose personal data can be transferred, the method and legal reason for collecting personal data, and other rights listed in Article 11. The KVKK disclosure text that does not contain this information in full may cause the data controller not to fully fulfill its disclosure obligation.
In addition, if the personal data processing activity depends on the explicit consent of the data subject, the data controller’s obligation to inform and obtain explicit consent must be fulfilled separately.
HOW IS THE KVKK DISCLOSURE TEXT PREPARED?
The obligation to inform can also be fulfilled by methods such as voice recording, verbal expression, pasting on the board. However, when the burden of proof that the person whose data is processed has been informed is on the data controller, it will be useful to have the clarification text in written form. It is important to use a clear, understandable and plain language in the clarification text to be prepared.
Does the LPPD clarification text need to be approved?
The clarification text is a unilateral obligation. For this, it is sufficient to announce the clarification text and it does not need to be approved by the relevant persons. However, if it is necessary for the data controller to obtain explicit consent for the personal data to be processed under the law, this must be fulfilled as a separate obligation.
Can the obligation to inform and the obligation to obtain explicit consent be fulfilled together?
According to Article 5/f of the Communiqué on the Procedures and Principles to be Followed in the Fulfillment of the Disclosure Obligation, “In case the personal data processing activity is carried out based on the explicit consent condition, the disclosure obligation and obtaining explicit consent must be fulfilled separately.” It is stated.
The data controller must first fulfill the disclosure obligation and then obtain explicit consent.
Is KVKK disclosure text mandatory?
The data controller, who processes data in the capacity of data controller with legal definitions, has the obligation to provide a KVKK disclosure text or obtain explicit consent depending on the nature of the data processed. It will be useful to get legal support from your lawyer in order to determine the scope of responsibility within the scope of the work you do and the data you process
