Series on Turkish Personal Data Protection Law (Edition 1): The Protection of Personal Data and Privacy Rights of Employees

The Turkish Personal Data Protection Law or "PDPL" (in Turkish: Ki?isel Verilerin Korunmas? Kanunu or "KVKK") No. 6698 is a comprehensive piece of legislation designed to safeguard individuals' personal data privacy in Turkey. The law also plays a critical role in protecting employees' personal information, as employers typically process, store, and share a substantial amount of personal data about their workforce. This personal data in relation to employees typically encompass sensitive information such as employment and contract details, health records, and social security numbers. As a result, the legal framework governing personal data protection for employees must adhere to the PDPL's principles.

This article seeks to analyze the PDPL's provisions related to employees' personal data protection and suggest strategies for ensuring the protection of workers' private data and rights. Moreover, it aims to provide guidance for foreign companies looking to do business in Turkey within the scope of the PDPL.

This is the first edition of our series on Data Protection Regulation applied in Turkey. Further editions will give more details on specific aspects in this edition. Subscribe to our Newsletter to get updates on all future editions.

The Importance of Data Protection in Light of Cyber Attacks and Data Leakage

In recent years, the threat of cyber-attacks and data leakage through hacking has increased exponentially, making data protection even more crucial for organizations worldwide. Data breaches can lead to the unauthorized disclosure of sensitive personal information, resulting in financial losses, reputational damage, and potential legal liabilities. This heightened risk emphasizes the need for organizations, including employers, to take data protection and cybersecurity more seriously than ever before.

Growing Cyber Threats

As technology continues to evolve, so do the methods and techniques employed by cybercriminals. Employers must be proactive in implementing robust security measures to protect their employees' personal data from cyber threats, such as ransomware attacks, phishing scams, and other malicious activities. Failure to do so can result in the compromise of sensitive employee information and expose the organization to significant legal and financial risks.

Regulatory Compliance

Given the increasing prevalence of cyber-attacks and data breaches, regulatory bodies worldwide have introduced more stringent data protection laws, such as the PDPL in Turkey and the General Data Protection Regulation (GDPR) in the European Union. Compliance with these laws is mandatory for organizations processing personal data, and failure to adhere to the required standards can lead to severe penalties, legal liability, and reputational damage. Employers must stay up to date with the latest data protection laws and ensure that their data protection policies and practices are in line with the current regulations.

Reputational Impact

Data breaches can have a lasting impact on an organization's reputation, as they often result in negative publicity and a loss of trust among customers, employees, and business partners. Consequently, organizations must prioritize data protection and cybersecurity to maintain their credibility and minimize the risk of reputational damage.

Financial Consequences

Data breaches can be financially devastating for organizations, as they often involve direct costs associated with the breach, such as investigation and remediation expenses, legal fees, and compensation payments (in addition to potential fines as mentioned above). Moreover, indirect costs, such as reputational damage and the loss of business, can have long-term financial consequences. By prioritizing data protection and implementing robust cybersecurity measures, organizations can minimize the risk of financial losses associated with data breaches.

In conclusion, the growing threat of cyber-attacks and data leakage through hacking has made data protection a top priority for organizations worldwide. Employers must ensure that they comply with relevant data protection laws, implement robust security measures, and continually assess their cybersecurity posture to safeguard employees' personal data and privacy rights. By doing so, organizations can minimize the risk of data breaches, maintain their reputation, and avoid potential legal and financial consequences.

Protection of Workers' Personal Data Under the Personal Data Protection Law

The PDPL imposes obligations on those processing personal data, including employers who collect, process, and use employees' personal data. Employers must obtain explicit consent from employees, who are the data subjects, and provide them with necessary information regarding data processing activities, data storage, transfer, and use. The PDPL also recognizes employees' rights to access their personal data held by their employers and the right to demand rectification or erasure where appropriate.

Collection of Explicit Consent

Under the PDPL, employers must obtain explicit and unambiguous consent from employees concerning the processing of their personal data. Employers must inform employees of the purpose of data processing and ensure that they are aware of their privacy rights. Employers must also ensure that the consent obtained from employees is specific, informed, and freely given and that it is not a precondition for employment. Therefore, when obtaining consent, employers must be transparent and clear about data processing activities and obtain consent after informing employees in a comprehensible manner.

Transparency (and Policies)

The PDPL requires employers to be transparent about their data processing activities concerning employees. Employers must provide a clear and comprehensible explanation of the nature, scope, purpose, and legal basis of the data processing activities. Moreover, employers must inform employees about their rights in relation to personal data processing, such as the right to access, rectify, or delete the data.

Employers must provide employees with a privacy notice that clearly outlines the personal data collected, the purpose of the processing, the legal basis for processing, the data retention period, and the rights that employees have in relation to their personal data. The privacy notice must be easily accessible and understandable to all employees.

Right to Access

Employees have the right to access their personal data which is collected and processed by their employer. Employers must provide access to all personal data concerning employees within a reasonable timeframe. Employees have the right to know how their personal data is being processed by the employer, the reason(s) for its processing, who has access to it, and how long it will be stored.

Employers must provide the requested information in a clear and understandable manner. The information must be provided free of charge and in a structured and commonly used electronic format, where possible.

Right to Rectification and Erasure

If employees observe incorrect or incomplete personal data in their employment records, they have the right to ask their employers to rectify this data immediately. Employers must also ensure that they erase or destroy personal data when the purpose of data processing has ended or when the employees have withdrawn their consent.

Employees have the right to request the erasure of their personal data under the following circumstances:

• if there is no longer a legal basis for processing,
• if they withdraw their consent,
• if they object to processing if their data has been unlawfully processed,
• or if the data is no longer necessary for the purpose for which it was collected.

Employers must respond to any such request in a timely manner and provide a detailed explanation of the action taken.

Technical and Organizational Data Security

Employers have a duty to ensure that employees' personal data is processed and stored securely. The PDPL requires employers to take appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, or destruction. This includes the drafting of appropriate policies and procedures to govern the handling of personal data.

Employers must implement physical and technical measures to protect personal data. These measures include secure access controls, encryption, and regular data backups. Employers must also conduct regular risk assessments to identify potential vulnerabilities and implement measures to address them.

Employee Awareness and Training

A vital aspect of ensuring compliance with the Personal Data Protection Law (PDPL) and safeguarding employees' personal data is implementing regular employee training and awareness programs. These programs aim to educate employees about the importance of data protection, their responsibilities in protecting personal data, and their rights under the PDPL.

By understanding their rights under the PDPL, employees can make informed decisions about their personal data and exercise their rights when necessary. This knowledge empowers employees to take control of their privacy and hold organizations accountable for their data protection practices.

Furthermore, when employees are well-informed about the PDPL and their responsibilities, organizations are more likely to achieve and maintain compliance with the law. A better understanding of the legal requirements can help employees identify potential issues and take appropriate action to prevent violations.

Educated employees are more likely to follow best practices when handling personal data, minimizing the risk of data breaches and unauthorized access. Training and awareness programs help ensure that employees understand the potential consequences of mishandling personal data and are aware of the steps they must take to protect sensitive information.

In conclusion, by implementing regular employee training and awareness programs, organizations can ensure that employees are well-equipped to handle personal data responsibly and comply with the Personal Data Protection Law (PDPL). In turn, this can help organizations minimize the risk of data breaches, maintain compliance with the law, and foster a culture of data protection within the workplace.

Data Breach Notification and Appropriate Response

In the event of a data breach involving employees' personal data, employers, acting as data controllers, have specific obligations under the PDPL to notify the affected parties and respond appropriately.

If personal data is unlawfully obtained by third parties, employers must notify the affected employees and the Turkish Data Protection Authority (DPA) as soon as possible. The DPA may, if necessary, publicize the breach on its official website or through other means it deems appropriate.

The PDPL has provided guidelines on the notification procedures and principles related to personal data breaches in the DPA's decision numbered 2019/10, dated 24 January 2019. According to this decision:

1. Employers must notify the DPA without delay and within 72 hours at the latest from the date they become aware of the data breach. Once the affected employees have been identified, employers must promptly notify them using appropriate methods.
2. If an employer cannot notify the DPA within 72 hours for justifiable reasons, they must explain the causes of the delay to the DPA along with the notification.
3. Employers are obliged to use the document attached to the DPA's decision when notifying the DPA about the data breach.

Employers should have a data breach response plan in place to ensure they can promptly and effectively address any breach involving employees' personal data. The plan should outline the steps to be taken in the event of a breach, including identifying the affected employees, assessing the scope and severity of the breach, and implementing appropriate measures to mitigate the risks and consequences.

By adhering to the PDPL's data breach notification and response requirements, employers can demonstrate their commitment to protecting their employees' personal data and privacy rights. This not only helps to maintain trust between employers and employees but also minimizes the risk of legal and financial consequences arising from data breaches.

International Data Transfers

The PDPL prohibits the transfer of personal data outside of Turkey unless adequate safeguards are in place to protect the personal data. Adequate safeguards include the use of standard contractual clauses with other processors, binding corporate rules, or the existence of an adequacy decision by the Turkish Data Protection Authority.

Employers must ensure that they have the necessary safeguards in place before transferring personal data outside of Turkey. Employers must also inform employees of any international transfers of personal data and the safeguards in place to protect the data.

Registration at VERBIS

Under the PDPL, organizations that process personal data need to register at?VERBIS, the Turkish Data Protection Authorities' Data Controllers Registry Information System. VERBIS registration is free and mandatory for all data controllers before they begin processing the data of Turkish residents (including employees). Once registered, data controllers are expected to record the data processing activities they engage in.

Enforcement, Violation, and Penalties

The Turkish Data Protection Authority (DPA) is responsible for enforcing the Personal Data Protection Law (PDPL). The DPA has the power to conduct investigations and audits to ensure that organizations are complying with the provisions of the law. If an organization is found to be in violation of the PDPL, the DPA can impose administrative fines, initiate legal proceedings, and even seek criminal sanctions in severe cases.

Employers who violate the PDPL can face significant fines, reputational damage, and legal liability. The fines for non-compliance can range from TRY 5,000 to TRY 1,000,000, depending on the nature and severity of the violation. The DPA takes into account factors such as the organization's size, the level of damage caused by the violation, and whether the violation was intentional or unintentional when determining the amount of the fine.

For example, an employer who fails to obtain explicit consent from their employees for the processing of their personal data could face a fine of up to TRY 100,000. Similarly, an employer who fails to adequately protect their employees' personal data from unauthorized access could face a fine of up to TRY 1,000,000.

In addition to the financial penalties, non-compliance with the PDPL can also result in reputational damage for the organization. If an organization is found to be in violation of the PDPL, it could lead to negative publicity and a loss of trust from both employees and customers. This could ultimately result in a loss of business and revenue for the organization.

Furthermore, violating the PDPL could also lead to legal liability for the organization. If an employee suffers harm as a result of a violation of their personal data, they could potentially seek damages through legal action. This could result in costly lawsuits and legal fees for the organization, in addition to the financial penalties imposed by the DPA.

In summary, employers who violate the PDPL can face significant financial penalties, reputational damage, and legal liability. It is crucial for organizations to take the necessary steps to ensure compliance with the PDPL and protect their employees' personal data to avoid these potential consequences.

Conclusion

The PDPL provides a robust legal framework for the protection of employees' personal data and privacy rights in Turkey. Employers must comply with the PDPL and ensure that they process workers' personal data securely, transparently, and with explicit consent. The protection of employees' personal data and privacy rights is crucial for building a trustworthy and productive workplace.

Employers must take necessary steps to safeguard their employees' personal data and privacy rights while complying with the PDPL's provisions. Employers must also ensure that their employees are aware of their rights and obligations under the PDPL and provide them with the necessary training and resources to comply with the law.

Additionally, foreign companies operating in Turkey should be aware of the PDPL and its provisions, taking necessary measures to avoid potential fines, reputational damage, and legal liability. The next edition will be focusing on the key considerations for foreign businesses.

Authors:

This article was prepared by?Ba?ak Bizden?and?Sven K?ksal. Please do not hesitate to reach out in case of further questions.