Regulations on the Protection of Personal Data in the Turkish Criminal Code and Criminal Acts

1. General 

''Crimes against Private Life and Confidentiality of Life'' are regulated between Articles 134-140 in the Ninth Section of the Second Part titled ''Crimes against Persons'' of the Second Book titled ''Special Provisions'' of the Turkish Criminal Code. In Article 134 of the Criminal Code, a general regulation has been made for the protection of private life, in case of any violation of the privacy of private life in any way, the act of violation is considered a crime and the perpetrator is punished, the audio and video contents of private life are specially protected and the minimum penalty foreseen for the perpetrator in case of disclosure of audio and video contents has been increased. Pursuant to the principle of legality in crime and punishment, which finds its basis in Article 38 of the Constitution of the Republic of Turkey and is clearly regulated in Article 2 of the Criminal Code, the actions regarding the processing of personal data are clearly defined as "recording", "giving" and "obtaining", "disclosure", "publication through the press "non-destruction" has been determined in a limited number with the method of counting. It is envisaged that the penalty will be increased in case of disclosure of special categories of personal data or publication through the press or if the crimes are committed by a public official by abusing the authority granted by his/her office or by taking advantage of the convenience provided by a certain profession or art. It is regulated that the investigation and prosecution of the crimes of recording personal data, unlawfully giving or obtaining data and not destroying data are not subject to complaint.

2. Offense of Violating the Privacy of Private Life 

Article 134 of the Turkish Penal Code titled "Violation of privacy" "Article 134 - (1) Anyone who violates the privacy of a person's private life shall be sentenced to imprisonment from one year to three years. If the privacy is violated by recording images or sounds, the penalty to be imposed is increased by one times. (2) 

Anyone who unlawfully discloses images or sounds related to the private life of persons shall be sentenced to imprisonment from two to five years. The same penalty shall also be imposed if these disclosed data are published through the press and broadcasting." The text of the article contains a general regulation for the protection of private life. Considering that personal data is within the private life of the person, it is seen that Article 134 contains a general regulation on the protection of personal data in this respect.  Since the article does not specify the types of actions that may violate the privacy of private life, it is understood that any criminal act that violates the privacy of private life will be within the scope of this regulation. The penalty to be imposed will be increased when the privacy of private life is violated by recording images and sounds that are within the scope of personal data related to private life.  In the event that the aforementioned audio and video recordings are disclosed, including through the press, the lower limit of the penalty has been increased from one year to two years and the upper limit from three years to five years.

When we examine the jurisprudence of the Court of Cassation regarding the scope of private life, we see that the Court of Cassation has kept the limits of private life broad. "The concept of private life, which constitutes the subject of the crime of violating the confidentiality of private life regulated in Article 134 of the TPC, does not only consist of the person's life and privacy behind closed doors, behind four walls, away from the eyes, which he does not share with others, but also includes all life events and information that are not known or should not be known by everyone, which can be disclosed to other people when desired, and which are completely private to the person. According to the European Commission, private life is the right to live away from the eyes of strangers and is to some extent defined as the right to establish and maintain emotional relationships with people in order to develop and realize one's own personality. In the doctrine, the private life of a person is defined as the private sphere consisting of the activities that the person does not want to be known by others and which are recognized by the law as a fundamental personal right whose confidentiality and protection is essential. 

Private life includes information and records related to the identity of the individual, behaviors related to sexual life, regulations regarding the physical and mental integrity of the person, private places such as the person's home, vehicle, telephone conversations, mail, name, photograph, fame and reputation, honor, lifestyle and prevention of misrepresentation to the public. While the individual is in a public place, the principle of 'inconspicuousness, unrecognizability, unknownness in the crowd' is valid, and the information obtained as a result of continuous supervision and surveillance of the person in the public place in order to determine matters such as what he/she does during the day, where he/she goes, who he/she meets with, why, how, where and when, or his/her activities that he/she would not want to be seen and known by others and that there is no doubt that they fall into the private life area are included in the scope of the concept of private life. When determining whether an event or information falls within the scope of the concept of private life, not only the characteristics of the physical environment should be considered, but also criteria such as the person's position in the society, profession, duty, whether he/she is known by the public, outward behavior, consent and foresight, social relations, and the degree of interference should be taken into consideration. (Court of Cassation Criminal General Assembly, Decision dated 15.12.2015 and numbered 2015/10 E., 2015/510 K.)

In the decision of the 12th Criminal Chamber of the Court of Cassation dated 19.01.2015 and numbered 2014/11530 Esas and 2015/584 Karar, the Court of Cassation ruled that "in the case where it is alleged that the victim disclosed her nude photographs sent with her consent on the internet by recording them on a flash disk and giving them to her father Mehmet; since the nude images of the victim regarding her sexual and physical privacy cannot be considered within the scope of personal data, the action will constitute the crimes of violating the privacy of private life in accordance with the 2nd sentence of Article 134/1 and Article 134/2 of the TPC, not the crime of recording personal data". 

3. Offense of Recording Personal Data 

Article 135 of the TPC titled "Recording of personal data" states that "(1) Anyone who unlawfully records personal data shall be sentenced to imprisonment from one year to three years.(2)

The penalty to be imposed pursuant to the first paragraph shall be increased by half if the personal data is related to the political, philosophical or religious views, racial origins, unlawful moral tendencies, sexual life, health status or trade union affiliations of the persons." With this regulation, the unlawful recording of all personal data without making any distinction between audio and video recording has been determined as a crime. It is regulated that the penalty will be increased in case of unlawful recording of personal data of a special nature relating to political, philosophical or religious opinions, racial origins; unlawful recording of personal data of a special nature relating to moral tendencies, sexual life, health status or trade union connections. 

4. Crimes of Unlawfully "Giving" or "Obtaining" Personal Data

Article 136 of the TPC stipulates that the perpetrator will be punished with a higher penalty than Article 135 in the event that personal data is unlawfully obtained, given to another person or disseminated. Article 136 of the TPC titled "Unlawful transfer or seizure of data" reads as follows: "(1) A person who unlawfully transfers, disseminates or seizes personal data to another person shall be sentenced to imprisonment from two to four years. (2) (Additional paragraph: 17.10.2019 - 7188 S.K/Article 17) If the subject of the crime is the statements and images recorded in accordance with the fifth and sixth paragraphs of Article 236 of the Criminal Procedure Law, the penalty to be imposed is increased by one."  Within the scope of this article, the penalty to be imposed will be increased by one times when the personal data illegally obtained, given to another person or disseminated are the statements and images of children during the investigation and prosecution phase in the crimes of sexual abuse of children and the statements and images of the victims of sexual assault during the investigation phase.

The crime of "unlawfully giving or obtaining data" in Article 136 of the TPC is regulated as an optional offense. The crime will be committed by performing one of the optional actions of unlawfully giving personal data to someone else, disseminating personal data and obtaining personal data (Court of Cassation Criminal General Assembly, decision dated 09.05.2019 and numbered 2015/708 E., 2019/414 K.).

According to the Court of Cassation, "unlawfulness" in Articles 134/2, 135 and 136 of the TPC is "the nature of the injustice that constitutes the crime, and what is meant by unlawfulness is that the act conflicts with the legal system and is contrary to the legal system. Law No. 5237 includes expressions such as "unlawfully", "with another unlawful behavior", "with other unlawful behavior", "with other unlawful behavior", "by unlawful means", "by unlawful means" in some crime definitions. In crimes where these expressions are mentioned, the perpetrator must know that the act committed is unlawful, in other words, he/she must act with direct intent in this regard. In the TPC No. 5237, the reasons for compliance with the law are: a- Fulfilling the provision of the law (Art.24/1) b- Legitimate defense (Art.25/1) c- Consent of the person concerned (Art.26/2) d- Exercise of the right (Art.26/1). Among the reasons for compliance with the law, it is useful to examine in detail the fulfillment of the provision of the law, the consent of the person concerned and the exercise of the right. As a matter of fact, in the justification of Article 134 of the TPC; "In the second paragraph of the article, unlawful disclosure of images or sounds related to the private life of a person is defined as a separate crime. For example, these images or sounds may have been legally recorded within the scope of the investigation, or they may have been obtained by committing the offense defined in the first paragraph. The offense defined in the second paragraph occurs with the disclosure and dissemination of these audio or video recordings, i.e. by ensuring that they are learned by unauthorized persons. This disclosure must be unlawful. In this respect, the offense in question will not occur if the recordings related to private life are given to the prosecutor's office or the court, or if they are shown and listened to at the hearing. Disclosure through the press and broadcasting is accepted as a qualified element of the crime in question. " (Court of Cassation Criminal General Assembly, decision dated 10.06.2014 and numbered 2013/551 E., 2014/311 K.).

Article 137 of the TCC, titled "Qualified cases", stipulates that the penalty to be imposed for the crimes of "Violation of the privacy of private life", "Recording personal data" and "Illegally giving or obtaining data" regulated in Articles 134, 135 and 136 of the Law will be increased by half in the event that the perpetrator is a public official and the crime is committed by abusing the authority given by his/her duty or by taking advantage of the convenience provided by a certain profession and art.

5. Failure to Destroy Personal Data 

Article 138 of the Turkish Penal Code regulates the offense of "Failure to Destroy Data", and the article stipulates that "Those who are obliged to destroy the data in the system despite the expiration of the periods determined by the laws will be sentenced to imprisonment from one year to two years if they fail to fulfill their duties, and the penalty to be imposed will be increased by one times if the subject of the offense is data that must be eliminated or destroyed according to the provisions of the Code of Criminal Procedure." Article 11/e of the KVK Law No. 6698 stipulates that the relevant persons may request the deletion or destruction of personal data from the data controller. Article 13 of the Law states that upon the application of the data subject, "The data controller shall finalize the requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Board may be charged."  In this case, if the personal data is not destroyed upon request within the one-month period determined by the law, the elements of this crime will have occurred. 

Provisional Article 1 of the KVK Law states that "Personal data processed before the publication date of this Law shall be brought into compliance with the provisions of this Law within two years from the date of publication. Personal data found to be in violation of the provisions of this Law shall be immediately deleted, destroyed or anonymized. However, consents obtained in accordance with the law before the publication date of this Law shall be deemed to be in compliance with this Law, unless a contrary declaration of will is made within one year." 

Since the Law regulates that personal data that are determined to be contrary to the provisions of the KVK Law and processed before 07.04.2016, which is the effective date of the Law, must be destroyed immediately, it should be taken into consideration that the act may also constitute a crime if the personal data processed in violation of the law before the effective date of the KVK Law is not destroyed in terms of the elements of the crime in Article 138. Pursuant to Article 7/3 of the Personal Data Protection Law, the Regulation on Deletion, Destruction or Anonymization of Personal Data was published on October 28, 2017 and entered into force on 01.01.2018. Article 11 of the Regulation sets out the periods for ex officio deletion, destruction or anonymization of personal data, and Article 12 sets out the periods for deletion and destruction of personal data upon the request of the data subject. 

It is regulated in Article 139 that the crimes of recording personal data, unlawfully giving or obtaining data and not destroying data regulated in the Turkish Penal Code are not subject to complaint, except for the crime of "violation of the privacy of private life", which is subject to complaint. Due to the offenses of recording personal data, unlawfully giving or obtaining data and not destroying data and the offense of "Violation of the privacy of private life", specific security measures will be imposed on legal entities.