The Personal Data Protection Board (“Board”), upon receipt of an application for complaint by a data subject regarding destruction of his own health report, to the Personal Data Protection Authority (“Authority”), whose father’s former application to the data controller was left unattended, evaluated whether the data subject complainant is able to exercise his right to complain before the Authority, since the data subject is under age 18, and if the complaint in question meet the procedural requirements in terms of the complainant.
The Board, in its decision dated 11.08.2020 and numbered 2020/622 (“Decision”) stated that
· Every individual, in accordance with the provision titled “Confidentiality of private life” included in the third paragraph of Article 20 of the Turkish Constitution, has the right to claim protection of their personal data, to be informed of their personal data, to access such data, to request correction or deletion of such data, to learn whether such data is used for its purpose;
· The purpose of the Law No.6698 on the Personal Data Protection Law (“PDP Law”), which entered into force in accordance with the third paragraph of Article 20 of the Turkish Constitution, is “to protect fundamental rights and freedoms of individuals, especially the right to privacy, with respect to the processing of personal data, and to regulate the obligations of natural and legal persons who process personal data and the procedures and principles to be followed”;
· In accordance with the relevant articles of the Turkish Civil Code numbered 4721, the minors who have the mental competence are not in need to obtain the consent of their legal representatives in terms of unpaid acquisitions and exercising the rights strictly attached to individuals;
· The rights of data subjects within the scope of the processing of their personal data are also rights strictly attached to individuals;
· In the present case, the applicant has the mental competence even though he has not completed the age of 18, and it should be deemed fit that protection of personal data is a right that is strictly attached to individuals and the consent of the legal representative is not required for the applicant to exercise this right, considering the best interests of the child;
· In accordance with the Regulation on Personal Health Data, people of partial disablement may also use the rights specified in Article 11 of the PDP Law in person, provided that they have mental competence, and both the minor and the parental guardian are authorized to access e-Pulse data unless otherwise stipulated by the minor, the mentioned regulation is also in line with the assessment that the right to protect personal data is strictly attached to individuals in terms of the present case.
· As a result of these evaluations, the Board, regarding the application for the destruction of the health report of the data subject who has not completed the age of 18 from the records, considering that (i) the minor has the mental competence and (ii) the overlap of the will of the data subject and his parental guardian regarding the application, decided that both the data subject and his father are authorized in terms of the application submitted before the data controller and the complaint delivered to the Board, and thus both of them can exercise their right to complaint before the Board; and an investigation regarding such petition should be initiated in accordance with Article 15/1 of the PDP Law.
We are pleased to assist you in any issue your Company may need, regarding data protection and privacy.