Personal Data Protection Board (“Board”) has clarified the periods for filing complaints to the Board and applying to data controllers stipulated under Articles 13 and 14 of the Protection of Personal Data Code (“Code”), with its Decision (“Decision”) dated 24 January 2019 and numbered 2019/9.
As per Article 13 of the Code, the related person can forward his / her requests to the data controller in written form or by other methods determined by the Board. The data controller should evaluate the application within the shortest time in accordance with the qualification of the application and within 30 days at the latest.
As per Article 14 of the Code, in cases where
- The application is rejected.
- The answer provided by the data controller is found inadequate.
- The response is not given within 30 days.
the related person may file a complaint to the Board within 60 days from the date of the application.
The Board has determined that the related persons have different interpretations of the provisions of the Code regarding application periods. Consequently, the Board issued the Decision in order to clarify the subject.
Under the Decision, the Board clarifies that:
- In cases where the data controller gives a response to the related person’s request within 30 days, the related person can file a complaint to the Board within 30 days following this response. In such cases, the related person does not have a 60-day period to apply to the Board after its application to the data controller.
- In cases where the data controller does not give a response within the stipulated time period, the related person has 60 days to apply to the Board starting from its application date to the data controller.
- In cases where the data controller gives a response after the end of the 30-day time period, the related person does not have 30 days following the reply date of the data controller, but it can file a complaint to the Board within 60 days following the application to the data controller. The related person is not obliged to wait for the data controller’s response after the end of the 30-day period as stipulated under the Code and has the right to apply to the Board.
Please see this link for the full text of the Decision. (only available in Turkish)
