{"id":17073,"date":"2023-06-13T09:05:42","date_gmt":"2023-06-13T09:05:42","guid":{"rendered":"https:\/\/www.pieravukatlik.com\/?p=17073"},"modified":"2023-06-13T11:32:25","modified_gmt":"2023-06-13T11:32:25","slug":"kargo-sirketi-kararlari","status":"publish","type":"post","link":"https:\/\/www.pieravukatlik.com\/en\/yayinlarimiz\/guncel-yazilarimiz\/kvkk\/kargo-sirketi-kararlari\/","title":{"rendered":"Personal Data Protect\u0131on Author\u0131t\u0131es Dec\u0131s\u0131ons on Cargo Compan\u0131es dated 05.01.2023 and dated 24.03.2022"},"content":{"rendered":"<div id=\"toc_container\" class=\"no_bullets\"><p class=\"toc_title\">\u0130&ccedil;indekiler<\/p><ul class=\"toc_list\"><li><a href=\"#Perakende_sirket_savunmasinda_ozetle\">In summary of the retail store\u2019s defense;<\/a><\/li><li><a href=\"#Kargo_sirketi_savunmasinda_ozetle\">In summary of the cargo company\u2019s defense;<\/a><\/li><li><a href=\"#Bu_degerlendirmelerden_hareketle_Kurum\">Based on these evaluations, the Board ruled that;<\/a><\/li><\/ul><\/div>\n\n<p class=\"has-medium-font-size translation-block\">The Personal Data Protection Board (\u201c<strong>Board<\/strong>\u201d) has evaluated the personal data violations arising from the shipping errors made by the cargo companies in two separate incidents, with its decisions numbered <a href=\"https:\/\/kvkk.gov.tr\/Icerik\/7598\/2023-4\" target=\"_blank\" rel=\"noopener\">2023\/4 dated 05.01.2023<\/a> and numbered <a href=\"https:\/\/kvkk.gov.tr\/Icerik\/7559\/2022-277\" target=\"_blank\" rel=\"noopener\">2022\/277 dated 24.03.2022<\/a>. Considering the similarities and differences of the events, we will compare and evaluate the decisions of the Board.<\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">First of all, the Board, with its decision dated 24.03.2022 and numbered 2022\/277, evaluated the delivery of a cargo package containing the personal data of the person concerned to a third party within the scope of the Personal Data Protection Law No. 6698 (\u201c<strong>KVKK<\/strong>\u201c).<\/p>\n\n\n\n<p class=\"has-medium-font-size\">In summary of the complaint made to the Board; the person concerned gave their headphones to an electronics retail store for repair. The store gave the headphones to a cargo company with a form containing the information of the person concerned to be delivered to the distributor company for repair. However, it was stated that the cargo was delivered to an unrelated third party.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-medium-font-size\"><span id=\"Perakende_sirket_savunmasinda_ozetle\">In summary of the retail store\u2019s defense;<\/span><\/h3>\n\n\n\n<p><\/p>\n\n\n\n<ul>\n<li class=\"has-medium-font-size\">in the cargo package, besides the product, there is a document required by the distributor company for the repair of the headset,<\/li>\n\n\n\n<li class=\"has-medium-font-size\">the cargo company delivered the package containing the personal data to a third party other than the address specified on the cargo, thus this was due to cargo company and<\/li>\n\n\n\n<li class=\"has-medium-font-size translation-block\">as stated in the <a href=\"https:\/\/www.kvkk.gov.tr\/Icerik\/4195\/Veri-Sorumlusu-ve-Veri-Isleyen\" target=\"_blank\" rel=\"noopener\"><em>Data Processor and Data Controller's Guide<\/em><\/a><em>\u2019<\/em> of the Board, cargo companies are data controllers in terms of personal data obtained to manage the shipment, therefore the store is not responsible for this situation.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p class=\"has-medium-font-size\">.<\/p>\n\n\n\n<p class=\"has-medium-font-size\">After hearing the complaint of the person concerned and the defense of the data controller, the Board decided to continue the investigation by taking the defense of the cargo company.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-medium-font-size\"><span id=\"Kargo_sirketi_savunmasinda_ozetle\">In summary of the cargo company\u2019s defense;<\/span><\/h3>\n\n\n\n<p><\/p>\n\n\n\n<ul>\n<li class=\"has-medium-font-size\">the aforementioned cargo was delivered to a third party and the cargo company became aware of the situation from the third party contact,<\/li>\n\n\n\n<li class=\"has-medium-font-size\">pre-service training was given to all employees of the company in the areas of personal data privacy and information security, and this training was given 3 times to the personnel who made the mistake and<\/li>\n\n\n\n<li class=\"has-medium-font-size\">the company has no knowledge of the content of the cargo and the retail company can follow a more secure way when transmitting personal data to the distributor company.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p class=\"has-medium-font-size\">.<\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">In the light of this information, the Board made its own assessments. The Board stated that the data processing\/transfer activity of the retail company by sending the information of the person concerned to the distributor company is based on the legal condition that \"<em>it is necessary for the establishment or performance of a contract<\/em>\". And that this situation is in accordance with the law, but that data should be shared as minimally as possible in the future.<\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">When the Board evaluates the retail company in terms of data security; it states that there is no violation since the company delivered the cargo package containing the personal data of the person concerned to the cargo company with correct information.<\/p>\n\n\n\n<p class=\"has-medium-font-size\">According to paragraph 5 of Article 12 of the KVKK, data controllers have an obligation to notify the Board within 72 hours in case of breach of data security. When the situation of the retail company is evaluated from this perspective; it is seen that the person concerned learned about this situation before the retail company, and after the person become aware about the situation, he made an application to the retail company. In addition, it was determined that 72 hours did not pass between the application made to the retail company and the complaint of the person concerned to the Board. Therefore, the Board become aware of the situation in that 72-hour timeline.<\/p>\n\n\n\n<p class=\"has-medium-font-size\">In the case, it has been determined that there is no illegality in retail company transmitting personal data via cargo. However, after learning that the data security has been violated, it has been stated that the retail company is obliged to notify the person concerned and the Board regarding the issue. However, it has been considered that it is controversial whether the person concerned would have taken other measures if the Board had been notified since the person concerned learned about the situation and notified the Board. The retail company is instructed to notify both the person concerned and the Board for similar events that may occur in the future.<\/p>\n\n\n\n<p class=\"has-medium-font-size\">When the situation is evaluated in terms of the cargo company, it has been evaluated that the cargo company, which is not expected to know the cargo content, does not carry out any personal data processing activities about the data subject as a data controller nor as a data processor, therefore, the cargo company does not have a notification obligation arising from KVKK.<\/p>\n\n\n\n<h3 class=\"wp-block-heading has-medium-font-size\"><span id=\"Bu_degerlendirmelerden_hareketle_Kurum\">Based on these evaluations, the Board ruled that;<\/span><\/h3>\n\n\n\n<p><\/p>\n\n\n\n<ul>\n<li class=\"has-medium-font-size\">it is legal for the retail company to send the document containing some personal data to the distributor company, but the retail company should be warned to minimize the information contained in this document in the future,<\/li>\n\n\n\n<li class=\"has-medium-font-size\">retail company should be instructed to notify both the person concerned and the Board as soon as possible in accordance with KVKK for similar events that may occur in the future,<\/li>\n\n\n\n<li class=\"has-medium-font-size\">keeping the facts that are the basis of the complaint of the person concerned and its role in this event in mind, the cargo company does not have the title of data controller or data processor in terms of cargo content, therefore there is no action to be taken by the Board about the cargo company, and<\/li>\n\n\n\n<li class=\"has-medium-font-size\">considering the case at hand, the person concerned should be informed that he or she can take action before the judicial authorities to pursue the civil and\/or criminal liability that may arise from the aforementioned erroneous transaction.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p class=\"has-medium-font-size\">.<\/p>\n\n\n\n<p class=\"has-medium-font-size\">This decision offers us a good perspective when considering another similar cargo company decision of the Board. In the other decision, the Board evaluated that the cargo company who made a wrongful cargo delivery by making a cross barcoding error has the title of data controller and decided to punish the cargo company that did not report the wrongful delivery made due to this barcode error to the Board in accordance with the KVKK.<\/p>\n\n\n\n<p class=\"has-medium-font-size\">Although the difference between these two decisions is not obvious at first, it reveals an important distinction. In the first decision we have given above, the personal information obtained; due to incorrect delivery of the cargo company, from a form placed in the cargo package. And in the other decision which have resulted in imposition of an administrative fine, the personal data which was violated because of the transaction made due to the cross-barcoding error was the recipient and sender information placed on the cargo package. While cargo companies do not have the title of data controller or data processor regarding the information contained in the package; they have the title of data controller in terms of the information that is placed on the cargo package.  Therefore, if the recipient and sender information on the cargo package does not contain any personal data, any action taken by the cargo company is outside the jurisdiction of the Board. In the decision that did not result in an administrative fine there was no personal information on the cargo package because the package had the information of the retail store and the distributor company.<\/p>\n\n\n\n<p class=\"has-medium-font-size translation-block\">You can <a href=\"https:\/\/www.pieravukatlik.com\/iletisim\/\" data-type=\"URL\" data-id=\"https:\/\/www.pieravukatlik.com\/iletisim\/\" target=\"_blank\" rel=\"noreferrer noopener\">reach<\/a> our \u0130zmir Personal Data Lawyers to get expert legal support on the protection of your personal data or your company's personal data law compliance.<\/p>","protected":false},"excerpt":{"rendered":"<p>\u0130&ccedil;indekilerPerakende \u015firket savunmas\u0131nda \u00f6zetle;Kargo \u015firketi savunmas\u0131nda \u00f6zetle;Bu de\u011ferlendirmelerden hareketle Kurum; Ki\u015fisel Verileri Koruma Kurulu (\u201cKurul\u201d) 05.01.2023 tarihli 2023\/4 say\u0131l\u0131 karar\u0131 ve 24.03.2022 tarihli 2022\/277 say\u0131l\u0131 karar\u0131 ile iki ayr\u0131 olayda kargo \u015firketlerinin yapm\u0131\u015f oldu\u011fu g\u00f6nderi hatalar\u0131ndan do\u011fan ki\u015fisel veri ihlallerini de\u011ferlendirmi\u015ftir. Olaylar\u0131n benzerliklerini ve farkl\u0131l\u0131klar\u0131n\u0131&#8230;<\/p>","protected":false},"author":2,"featured_media":17076,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[66],"tags":[],"_links":{"self":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts\/17073"}],"collection":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/comments?post=17073"}],"version-history":[{"count":10,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts\/17073\/revisions"}],"predecessor-version":[{"id":17084,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/posts\/17073\/revisions\/17084"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/media\/17076"}],"wp:attachment":[{"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/media?parent=17073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/categories?post=17073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pieravukatlik.com\/en\/wp-json\/wp\/v2\/tags?post=17073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}