The protection of personal data has become an integral component of safeguarding fundamental rights and freedoms in the digital age. While the General Data Protection Regulation (“GDPR”) in the European Union and various sector-specific regulations in the United States demonstrate the increasing significance of this area, personal data protection in Türkiye was placed under constitutional guarantee with the amendment introduced in 2010, followed by the adoption of the Law No. 6698 on the Protection of Personal Data (“KVKK”). Within this framework, one of the most notable elements is the individual’s right to request and access their own personal data.
The Legal Foundation of the Right to Access Personal Data
Article 20/3 of the Constitution explicitly recognizes the right of every individual to request the protection of their personal data. This right encompasses not only the ability to prevent the processing of such data, but also a broader set of entitlements, including the right to obtain information about processed data, to request the rectification or deletion of such data, and to learn the purposes for which it is used.
As a complementary safeguard to the constitutional protection, the rights of data subjects are further and more comprehensively regulated under the KVKK. Pursuant to Article 11, individuals have the right to learn whether their personal data is being processed, to request information if such processing has occurred, and to inquire about the purposes of processing. In addition, KVKK expressly grants the right to learn whether personal data has been transferred to third parties, to request the correction of incomplete or inaccurate data, and to request the deletion or destruction of personal data where the conditions for processing no longer exist.
Individuals whose personal data is processed may exercise the rights guaranteed to them under the Constitution and the Law by submitting a request to the data controller. The data controller is obliged to respond to such requests within thirty days. If the data controller fails to respond within this period or if the response is deemed insufficient, the data subject may file a complaint with the Personal Data Protection Board. In this respect, individuals are provided not only with a theoretical entitlement but also with an effective mechanism to access their personal data and exercise control over it.
It should be noted, however, that the right of access is not without limits. This right may be restricted where necessary for the protection of public order, national security, or the rights and freedoms of third parties. Any such restriction must pursue a legitimate aim, have a basis in law, and comply with the principle of proportionality. Otherwise, the restriction would undermine the very essence of the right and result in a violation. Recent decisions of the Constitutional Court clearly demonstrate that the right to access personal data is not merely an individual claim but also imposes binding obligations on public authorities and private entities. In this context, the Constitutional Court’s decision dated 17.07.2024 with application no. 2019/39889 and explained in detail below, has determined the extent of the right to request personal information in the context of a public servant’s application, which can be applied to various other examples.
Constitutional Court Decision
In the case reviewed by the Constitutional Court, the applicant applied to the Ministry of Foreign Affairs through their attorney, requesting copies of the performance evaluations and assessment reports contained in their personnel file. This request followed the decision to terminate her assignment at the Embassy of Buenos Aires—an assignment initially planned for a four-year term—after only the first year. However, the Ministry rejected the request on the grounds that “public institutions are not obliged to provide the information and documents required by the lawyer by sending them outside the institution. Accordingly, it does not appear possible to send the requested information and documents to you.”
Following the Ministry’s refusal, the applicant brought an action before the administrative court seeking annulment of the administrative act. The court, however, dismissed the case by relying on paragraph 1(d) of the Public Personnel Communiqué, which provides that “in the keeping and preservation of personnel files, the principle of privacy of private life shall be observed. The contents of personnel files may not be disclosed or provided to persons other than authorities empowered to conduct investigation or prosecution. Moreover, no publication regarding the individual may be made on the basis of the information and records contained in the personnel file without the individual’s consent.” Upon the dismissal of their appeal, the applicant lodged an individual application before the Constitutional Court, alleging a violation of their right to the protection of personal data within the scope of the right to respect for private life.
The Constitutional Court found that the performance evaluations and assessment reports requested by the applicant, although related to their professional activities, constitute personal data by their very nature. Accordingly, the Court evaluated the applicant’s request within the scope of the right to respect for private life under Article 20 of the Constitution. The Court further emphasized that the right of access to personal data is a direct reflection of the “right to request the protection of personal data,” which is guaranteed under Article 20(3) of the Constitution.
The Court noted that this constitutionally protected right may only be restricted by law, pursuant to Article 13 of the Constitution. In the present case, the Circular relied upon by the administration was found to concern the authorities of third parties rather than the applicant, and therefore did not constitute an appropriate legal basis for restricting the applicant’s right of access to her personal data. Consequently, the Court held that the Circular could not serve as a legitimate ground for rejecting the applicant’s request and underscored that subordinate legislation cannot be used to impose limitations on fundamental rights and freedoms.
In light of these assessments, the Court concluded that preventing the applicant from accessing her own personal data constituted a violation of the right to request the protection of personal data, which is guaranteed under Article 20 of the Constitution. The Court additionally emphasized that restrictions affecting the essence of this right may only be introduced by law, and that limiting the right of access through regulatory acts or administrative practices fails to satisfy the requirements of foreseeability and legality.
Ultimately, the Constitutional Court acknowledged the right to request personal information as an extension of the right to the protection of personal data, and decided that an individual’s access to their personal data may be restricted for legitimate reasons such as the protection of public interest or the rights of third parties only on a statutory basis. Please refer here for the full text of the decision.