With its decision dated 21 April 2022 and numbered 2022/388 (“The Principal Decision”), the Personal Data Protection Board (“Board”) rules that accessing the real estate information of citizens only by entering their Turkish ID number on the real estate tax payment / fast payment or debt inquiry web pages constitutes a breach in terms of Personal Data Protection Law numbered 6698. The Principal Decision was published by the Board in Official Gazette dated 29 April 2022 and numbered 31824 and is binding for all data controllers.
With the Principal Decision, the Board once again underlines that data controllers and data processors cannot disclose the personal data they have learned in violation of the provisions of the Law and cannot use them for any other reason than the purpose of processing.
Additionally, the Board, by referring to the Personal Data Security Guide published to provide clarity in practice on the technical and administrative measures that data controllers should take in personal data processing processes; draws attention to the necessity of applying two-stage authentication control as a technical measure in case of remote access to personal data.
The Board decides on following matters in this Principal Decision:
- Municipalities should take the necessary technical and administrative measures within the scope of article 12 of the Law by using two-step verification for the web-based inquiry services they offer;
- The public should be informed that action will be taken against the relevant municipality in accordance with article 18 of the Law in line with the complaints / notifications to be sent about the municipalities that do not take the aforementioned measures.
You can access the full text of the Principal Decision via this link. (Only available in Turkish)
