Can a Natural Person Whose Personal Data is Processed Unlawfully Claim Moral Compensation for Attack on Personal Rights?

1. Personal Data and Personal Rights  

For a better understanding of the subject, it is useful to first explain the concepts of "personal data" and "personality right".  As defined in the Law, "personal data" is any information relating to an identified or identifiable natural person. As stated in many decisions of both the European Court of Human Rights and the Constitutional Court, data such as a person's name, surname, political opinion, associations he/she is a member of, habits, favourite books, sports activities, punishments received, crimes he/she has been tried for, information and records related to these crimes, etc. have been accepted as personal data to be protected. In the decision of the Criminal General Assembly of the Court of Cassation numbered 2014/331 K., even if the person is acquitted, information and documents related to a crime for which the person concerned is on trial are accepted as "personal data".

"Right of personality" is not clearly defined in the Turkish Civil Code or any other law. It is accepted in the doctrine that the right of personality is a comprehensive right that includes all values on the material and moral integrity of the person and that personal data is often included in this value. The person will want to exist, develop, be free, use the possibilities of human beings and be respected, and will need personality rights in order to fulfil the requirements of being human. 

In various decisions of the Court of Cassation, the right of personality refers to the ".... rights on the values that make up the personality, which are strictly protected and strictly bound to the person. An attack on elements such as the life, physical and mental health, bodily integrity, freedom, honour and dignity, privacy of private life and secrets of the person is considered a violation of the right of personality. However, since personality rights are a dynamic field that can change according to time and the conditions of the situation, it is not possible to make a limiting enumeration of its scope."  

Although the definition of the right of personality is not defined in the Turkish Civil Code (TCC), the "right of personality" is protected under Article 24 in the "Personality" section of the first part of the first book of the law titled Law of Persons, which is allocated to natural persons. Article 24 of the TCC, which is regulated to protect personality rights, reads as follows: "Anyone whose right to personality is attacked unlawfully may ask the judge for protection against the attackers. Unless the consent of the person whose right of personality is damaged is justified by a superior private or public interest or the exercise of the authority granted by law, every attack on personality rights is unlawful." In the event that personal data is processed (shared, recorded, changed, stored, obtained, etc.) unlawfully without the consent of the person concerned, the person's mental health, honour, dignity, privacy of private life may be damaged and personal rights will be attacked.

2. Examples of Cases Submitted to the Judiciary Regarding Violation of the Right of Personality Due to Unlawful Personal Data Sharing 

Examination of the decisions of the Court of Cassation on the subject will enable a better understanding of the issue.  

As a result of the sharing of the pages of the plaintiff's passport with photographs and identity information in a way to be read in the news made in the press with the title "Jewish Grooms of Generals", it was accepted that the news constituted an attack on personal rights and non-pecuniary damages were awarded. (Court of Cassation 4th HD. Decision No. 2021/1575 K)   

In the event that one of the spouses accessed the personal data of his spouse without his knowledge by obtaining the "e-government" password with a photocopy of the other's identity card during the period when the divorce case was ongoing, it was decided that personal rights were attacked and an appropriate amount of non-pecuniary damages should be awarded in favour of the plaintiff. (Decision No. 2017/2970 K of the 4th HD of the Court of Cassation)  

In the case where a telephone line was issued by making a subscription contract in the name of the plaintiff by using the plaintiff's identity information and forging his signature without the plaintiff's consent, and enforcement proceedings were initiated against him due to non-payment of the debt, it was decided to award non-pecuniary damages on the grounds that the plaintiff's personal rights were violated because the defendant AŞ did not take measures to prevent the unlawful processing of the plaintiff's personal data and making fake subscriptions, did not select and supervise the dealer well.  

The claim for non-pecuniary damages was rejected in the lawsuit filed on the grounds that the claim that the plaintiff took part in a nationalist group when he was a student and threatened the Dean of the Faculty of Law during his nationalist activities was shared in the press after he was elected as an examining judge to the Council of State 20 years after the incident, violated his personal rights. (Decision No. 2020/30 K of the 4th HD of the Court of Cassation) 

The Court of Cassation rejected the claim for non-pecuniary damages by rejecting the allegation of violation of personal rights as a result of the MP stating at a press conference that the asylum seekers who fled the war in Syria and came to Turkey had acquired Turkish citizenship and that the asylum seekers had been given a Republic of Turkey identity card and showing a photocopy of the plaintiff's identity card to the press members to support his claim.

In the decision of the Court of Cassation General Assembly of Civil Chambers numbered 2014/56 E, 2015/1679 K., it was decided to award non-pecuniary damages for the act of sharing personal data containing the name of the person without the consent of the person concerned by referring to the right to be forgotten. 

The relevant part of the decision reads as follows: "In the event that the name of the victim of an event that took place 4 years ago is clearly written and included in the book, it should be accepted that the right to be forgotten and as a result, the privacy of the plaintiff's private life is violated. As the Court of Justice of the European Union explained in the "Google Decision", personal data should not be explicitly included in the decision taken in the scientific work, as there are no special reasons that reveal a superior public interest in the form of the important role played by the relevant data in public life and the intense public interest in the relevant data. During the discussions, the members in the minority argued that there was no need to pseudonymise the names in the court decisions, that the proceedings were held openly with exceptions, that the judgement was publicly announced, and therefore the privacy of private life was not violated, but this view was not accepted by the majority of the board on the grounds that "the problem is not the inclusion of the names in the court decisions without pseudonymisation, but whether the decisions should be pseudonymised during the inclusion of the decisions in the book".  Therefore, considering that the inclusion of the plaintiff's name in the book without pseudonymisation violates the right to be forgotten and consequently the right to privacy, it is obligatory to accept that the conditions for non-pecuniary damages are fulfilled in favour of the plaintiff."

3. Legal remedies in case of violation of personality rights 

Pursuant to Article 25 of the CC, anyone whose personal right is attacked by violating the right to protection of personal data may request from the court of his/her own domicile or the court of the defendant's domicile to prevent the danger of attack, to put an end to the ongoing attack, and to determine the illegality of the attack whose effects continue even if it has ended. The plaintiff may also request the judge to notify or publish the correction or the decision to third parties. The person whose personality rights have been damaged may also request material and moral damages, and may also request that the earnings obtained by the defendant due to the unlawful attack be given to him in accordance with the provisions of labour without attorney. 

Article 646 of the Turkish Code of Obligations (TCO) states that the TCO is the Fifth Book of the Turkish Civil Code dated 22/11/2001 and numbered 4721 and is complementary to the TCC. Article 49 of the TCO reads as follows: "Whoever causes damage to another by a defective and unlawful act is obliged to compensate for this damage. Even if there is no legal rule prohibiting the damaging act, the one who intentionally harms another by an immoral act is also liable to compensate for this damage." The TCO also protects personal rights against attacks with a special provision in Article 58. Article 58 of the TCO reads as follows: "The person who is harmed by the damage to his/her right of personality may request the payment of a sum of money under the name of moral compensation for the moral damage he/she has suffered. Instead of the payment of this compensation, the judge may decide on another form of compensation or add it to this compensation; in particular, he may issue a decision condemning the attack and may order the publication of this decision."

This article was previously published at www.kvkhukuku.com