Turkish Personal Data Protection Board Ruling Search Engine Operators as Data Controllers

Personal Data Protection Board in Turkey concluded that search engine operators are data controllers for the purpose of Turkish Law on the Protection of Personal Data as the purposes and means of the processing of data collected by third parties on the internet, search engine operators are to be classed as data controllers.

Following the introduction of Personal Data Protection Law in Turkey, Personal Data Protection Authority was established on 30 January 2017.

Turkish Personal Data Protection Authority is a public legal entity and has administrative and financial autonomy. It is composed of the Board and the Presidency. The decision-making body of the Turkish Personal Data Protection Authority is the Board. According to Article 21 of the Personal Data Protection Law, no body, authority, office or person shall give orders and instructions, recommendations or suggestions to the Board on matters falling within the scope of its duties and powers. The most important duties and powers of the Board including but not limited to:

• ensuring that the personal data are processed in compliance with fundamental rights and freedoms in Turkey
• concluding the complaints of those who claim that their rights with regard to personal data protection have been violated. I
• examining whether the personal data are processed in compliance with the laws, upon complaint, or ex officio where it learns about the alleged violation, and to take temporary measures, if necessary.
• deciding on the imposition of administrative sanctions provided for in the Personal Data Protection Law in Turkey.

Arising from the above-mentioned duties and powers; Board has recently examined and concluded on several complaints by its Decision dated 23/06/2020 and numbered 2020/481 regarding the ‘right to be forgotten’ which has brought crucial impacts on the personal data indexed by search engines such as Google.

Even though the ‘right to be forgotten’ has not been codified in any piece of legislation under Turkish law, Board in its Decision has referred to Article 20 of the Constitution; Article 4, 7 and 11 of the Law on Personal Data Protection and Article 8 of the Regulation on the Erasure, Destruction or Anonymization of Personal Data together with several Court of Cassation decisions to rule that Right to be Forgotten is recognised by Turkish Legal System. Furthermore; it is recognised that the right to request the results not to be given for the names and surnames arising from the search in a search engine, is a request of removal from the search engine index.

Within the above framework on ‘right to be forgotten’ and ‘right to request the removal of name & surname from search engine index’, Turkish Personal Data Protection Board considers that;

• as search engines determine the purposes and means of processing the data collected by third parties on the internet, they are accepted as data controllers within the scope of Turkish Law on Personal Data Protection,
• as the operator of the search engine automatically, regularly and systematically finds the information published on Internet, then organizes personal data in the form of a list of search results, stores it on its servers, discloses it in certain situations and presents it to its users, the activities of the search engines involve 'personal data processing' within the scope Turkish Law,
• Based on the procedures and periods specified in the provisions of the Law on the right of application and complaint, the data subjects should first apply to the search engines regarding their requests to remove the search results from the index, if the data controller search engines refuse such requests or do not respond to the applicant, then they can complain to the Board,
• The form of the application to be made by the data subjects and the information and documents to be requested will be determined by the search engines,
• In the evaluation of the requests to be made by the data subjects for the removal of the results displayed from the index following a search made based on their name and surname through the search engines, conducting a balancing test between the fundamental rights and freedoms of the data subject and the interests that the public will obtain from the information in question, observing which of the competing interests outweigh,
• It is possible for the data subjects to apply directly to the judiciary while applying to the Board if their requests for the removal of the results shown as a result of the searches made with their own names and surnames through the search engines are rejected by the data controller search engines or if their requests are not answered.