INFORMATION NOTE ON THE ANNOUNCEMENT BY THE PERSONAL DATA PROTECTION BOARD ON THE APPLICATION AND COMPLAINT PERIODS


18 FEBRUARY 2018

The Personal Data Protection Board (“Board”) has issued a decision (“Decision”), which was announced on 13 February 2019, and evaluated various probabilities in order to eliminate certain uncertainties regarding the application and complaint periods regulated under the Law on the Protection of Personal Data No. 6698 (“Law”).

The Law regulates the obligations of the parties who have access to the data, mainly the data controller, and the rights of the data subjects. Accordingly, Article 13 and Article 14 of the Law set out the remedies regarding the application processes to be carried out by the data subjects and the complaints to be made by the data subjects to the Board.

Pursuant to Article 13 of the Law, the data controller is obliged to respond to the applications made by the data subjects within 30 days at the latest. According to Article 14 of the Law, the data subject’s right to submit a complaint to the Board is reserved, in case the application is rejected, replied insufficiently, or not replied in due time. However, as clearly stipulated under the Law, the data subject must complete the application process with the data controller, before submitting a complaint to the Board within the scope of Article 14 of the Law.

The Decision has determined the application periods based on three different possibilities in order to eliminate the uncertainties on the application and complaint periods regulated under the Law:

  • (1) Within 30 days following the response of the data controller, if the application is responded within 30 days by the data controller;
  • (2) Within 60 days following the date of the application made by the data subject to the data controller, if the application is not replied in due time;
  • (3) Within the 30 days after 30-day response period has expired (60 days following the date of application), if the data controller provides its response after the expiry of the 30-day period.

The 60-day periods indicated in the Decision, should be considered as a new 30-day period which will start at the end of the 30-day period following the application.

Furthermore, even if the data controller provides a response to the data subject within the 30-day period, the data subject can make a complaint to the Board within 30 days following the response of the data controller, if the data subject is of the opinion that the response is insufficient.

Should you have any queries, please do not hesitate to contact us.

Güner Law Office was established in 1996 and has since grown into one of the major corporate, M&A, banking, litigation, energy, TMT and capital markets practices in Turkey.