Processing Personal Data
Personal data can be processed based on the below specified legal ground:
- If explicit consent of the data subject is obtained;
- If processing is clearly proposed under the laws;
- If processing is mandatory for the protection of life, or to prevent the physical injury of a person, in cases where that person cannot express consent, or whose consent is legally invalid due to physical disabilities;
- If processing is necessary for and directly related to the establishment or performance of a contract and limited to the personal data related to the parties therein;
- If processing is mandatory for a data controller to fulfil its legal obligations;
- If the data is made manifestly public by the data subject;
- If processing is mandatory for the establishment, exercise, or protection of certain rights; and
- If processing is compulsory for the legitimate interests of the data controller, provided that fundamental rights and freedoms of the data subject or any related person are not compromised.
Processing Sensitive Personal Data
The Data Protection Law divides sensitive personal data into two categories:
- Personal data on health or sexual orientation; and
- “Other” sensitive personal data.
Personal data related to health or sexual orientation is protected more strictly than other sensitive data, as the scope of the additional legal grounds for processing is very limited. Reserving the requirement to process data by obtaining the explicit consent of the data subject, personal data related to health or sexual data can only be processed by persons under an obligation of confidentiality, or by authorised institutions and establishments, for protection of public health, protective medicine, medical diagnosis, treatment and care services purposes.
For other types of sensitive personal data, these can only be processed with the data subject's explicit consent or if such processing is required by law.
In Turkey, processing sensitive data, especially health data, must be diligently handled under the current legal backdrop. We have specific industry knowledge in health care where we frequently advise our clients to process health data in different fields and for various purposes, including new technologies, quality services, pharmacovigilance or clinical trials.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.