New law to safeguard privacy

The bill on protection of personal data is a legal arrangement complementing a proposal referred to Parliament about two weeks ago governing state secrets and transparency. Both bills are part of reforms driven by Turkey's bid to become a member of the European Union.

The two bills' adoption will establish two autonomous councils to oversee their implementation. The proposal on state secrets regulates the confidentiality classification of information and documents, while the new privacy law establishes parameters for the legal classification of information as personal. The 41-article draft also defines circumstances in which the state may collect personal data and strictly regulates the conditions for relaying such information to third parties.

Under the bill, no agency will have the authority to record information about an individual's race, political opinions, philosophical beliefs, religion, denomination or other type of convictions; membership in an association, foundation or a union; health condition; or private affairs. It also introduces strict restrictions on the handling of police and criminal records. The bill allows the gathering of personal information only when the interest of the public good necessitates such information gathering -- and only as long as there is legislation in place ensuring the confidentiality of such data. The bill foresees citizens' right to know whether at any point personal information about them has been recorded; the right to review any such data; and demand correction in cases of erroneous, mistaken or inadequate data. Data collection shall not take place under the permission of the relevant individual, with the exception of cases where legal obligations might be involved, the bill proposes.

The bill also introduces jail sentences of six months to three years for individuals collecting personal information illegally. Individuals who disclose private information, convey it illegally to a third party or acquire it illegally face jail time ranging from one to four years. Fines ranging between YTL 1,000 and YTL 10,000, are also introduced for violations of personal privacy laws.

The law allows the conveyance of personal information about an individual to a third country only if in that country legislation in place offers equivalent and effective protection of privacy.

Under the new bill, an autonomous privacy watchdog will be established, endowed with the authority to act completely independently of the government. This privacy protection council will have the authority to decide whether to record personal information as long as there is no violation of privacy in a specific case.

The council, which according to the bill will have bi-monthly meetings, will have seven Cabinet-appointed members on its board. All of its members will be Turkish university faculty members. In addition to an advanced degree, the bill requires at least 10 years of teaching experience at an institution of higher learning for the members of the council. Each member will serve six years in office.

Registering criminal offenses

The bill introduces strict restrictions on the handling of police records on individuals. It allows gathering personal information only in cases where collection of such information is not a breach of private life and when the overall public good necessitates it, and only as long as there is legislation that ensures the preservation of such data in confidence. However records of criminal offenses will be subject to monitoring only by the Justice Ministry.

The bill allows using personal information for polls, planning, research and statistical purposes only as long as individuals remain anonymous. Such anonymous data will be permitted to be passed on to third parties or be published.

Information and third parties

Third persons are permitted access to an individual's personal information only in cases specified by law. The sharing of such data with relevant institutions will be permitted in cases where national security or national defense requires intelligence collection to prevent a crime or to investigate a crime. Sharing such information with third parties might be limited, made conditional or refused entirely in cases where the concerned individual's legitimate interests or the public good is concerned.

Safeguarding privacy and the media

The bill also introduces some exceptions to general privacy protection laws for cases when the registration or tracking of personal information is for journalistic purposes. The principles of registering personal data and measures to protect such data will be subject to laws regulating publishing and journalism.

The use of personal information by health centers, insurance companies, social security institutions, businesses obliged to have their own nurseries, medical schools and universities is also allowed with certain conditions regarding medical treatment.

Personal information whose preservation is not required by law will either be made anonymous or destroyed. The procedures and conditions regulating when and under what circumstances such data should be made anonymous will be decided by a charter to be prepared by the personal information protection council.