05 Sep Brıef Regardıng Personal Data Protectıon Board’s Decısıon On Commercıal Tıtles
Clarifying matters of personal data and its processing, the Personal Data Protection Board (“Board”), also makes evaluations regarding the data processors with natural or legal entity. While any transaction made by the data processors regarding all kinds of personal data should be evaluated within the scope of the Law No. 6698 on Personal Data Protection (“KVKK“), limits to the data which will be considered within the context of KVKK poses another issue to assess. In this brief, we present the evaluations made by the Board on this issue in its decision.
Within the framework of the Board’s decision dated 10.02.2022 and numbered 2022/103, posting the contents of a file regarding the enforcement proceedings initiated against a company whose commercial title contains the name of the data subject, on social media has been evaluated within the scope of KVKK.
The complaint submitted to the Board stated that; following making a transaction with the data controller company, enforcement proceedings were initiated against a company whose commercial title contains the name of the data subject. Afterwards, mentioned enforcement file was posted in a public group on Facebook, and personal rights were violated via sharing the personal data in the enforcement file with third parties.
In his defense, the data controller claimed that (i) the post was not shared under the name of the data controller, (ii) the post was shared by a former employee, and (iii) it was done so that other companies would not be harmed.
The Board, ruled that the complaint subject is not within the scope of the law based on the following evaluations;
- Personal data is identified as any information relating to an identified or identifiable natural person,
- As it was stated in the opinion of the Article 29 Data Protection Working Party, based on the Data Protection Directive numbered 95/46/EC, dated 04.06.2007 and numbered 4/2007; the issue on whether any information about legal persons is "related" with real persons should be considered specifically for each case in the light of the criteria specified in the opinion and
- Although the name and surname of the data subject is included in the commercial title contained in the document of enforcement proceedings, mentioned data does not meet the definition in the Law, considering that; (i) only the legal entity is targeted within the context of the post and the comments and (ii) the information is not directed to a real person or does not have an effect on the rights and interests of a real person.
.
The evaluations made by the Board in the aforementioned decision are of significance, and a resolution has been reached based on the determinations specific to the case such as the content of the relevant post and the target of this post. In its decision, the Board also expressed the sources and methodology used while reaching this resolution in detail. The Board aims to carry out a clear and open decision-making process by including its methodology in its decisions and to guide everyone operating in this field. In our opinion, even one does not encounter a similar process, such decisions are of great importance since they inform and guide us about the decision-making process and perspective of the Board.
