The new decision of the Constitutional Court on the right to request protection of personal data has been published. In the decision, the Constitutional Court stated that the government has an obligation to establish an effective judicial system. In the concrete case, the Constitutional Court decided that such obligation is not fulfilled and, accordingly, the right to protection of personal data within the scope of the right to respect for private life was violated.
Recent development
The Constitutional Court’s new decision, no. 2018/30296 (“Application“) dated 7 September 2021 regarding the right to request the protection of personal data, was published in the Official Gazette dated 14 October 2021. The decision is available online here (in Turkish).
Background
The applicant (“Applicant“) claimed that their[1] right to request protection of personal data has been violated due to their spouse’s unlawful access to their personal data by installing a spyware on their phone within the scope of their divorce. The Applicant filed a complaint claiming that their spouse had access to their personal data using spyware and tried to use this data as evidence in the divorce case. The spyware allowed access to the Applicant’s calls, messages, photographs and videos. Upon the Applicant’s complaint, an investigation was initiated by the related public prosecutor’s office and the trial began before the related criminal court. The criminal court stated that the information obtained was used as evidence for the divorce lawsuit, and there was no intent to commit a crime. Regional courts of justice also upheld the decision of the criminal court, stating that personal data can be recorded, seized and disclosed in order to be presented as evidence before competent authorities if there is a risk that they might be lost. The Applicant applied to the Constitutional Court claiming that their right to respect for private life and freedom of communication were violated.
What does the decision say?
The Constitutional Court stated that the information on the Applicant’s phone constitutes personal data and evaluated the Applicant’s claims in terms of the right to protection of personal data within the scope of the right to respect for private life. The Constitutional Court stated that Article 20 of the Constitution of Republic of Turkey (“Constitution“) not only provides protection with regard to the processing of personal data, but also provides a guarantee against all kinds of interference and restrictions on personal data. Within the scope of the relevant right, the government has a positive obligation to protect their citizens against the risks that may arise from the actions of public authorities, other individuals and the person itself. As a reflection of this, the government should establish an effective judicial system for the resolution of disputes. These judicial systems should protect fundamental rights and freedoms of the individuals and, accordingly, the decisions should be based on relevant and sufficient grounds.
The Constitutional Court stated that as the personal data of the Applicant had been illegally accessed and disclosed, an effective criminal investigation and prosecution was necessary. The competent criminal court stated that the defendant spouse’s actions were aimed at protecting the evidence and such data were being used as evidence in the divorce lawsuit. However, it has been observed that no further investigation has been carried out on the categories of the personal data obtained, duration of the access to personal data and whether changes have been made to the data itself. Such matters were not included in the legal grounds of the criminal court as well. Furthermore, no evaluation has been made as to whether the spouse’s purpose of accessing personal data is legitimate. The Constitutional Court stated that the approach of the criminal court could lead to the conclusion that the spouses do not have privacy from each other and such approach is in violation of the constitutional guarantees. Accordingly, the legal grounds of the criminal court were not found relevant and sufficient.
In light of the foregoing, the Constitutional Court evaluated that the obligation to establish an effective judicial system is violated as the allegations were not deeply investigated and the legal grounds did not have legal basis. Since the relevant obligation is not fulfilled, the Constitutional Court decided that the right to protection of personal data within the scope of the right to respect for private life was violated.
Conclusion
In this decision at hand, the Constitutional Court pointed out that the Article 20 of the Constitution provides protection against all kinds of interference on personal data and underlined the positive obligations of the government in order to ensure the exercise of constitutional guarantees. Accordingly, when evaluating the claims regarding unlawful access to personal data, the courts of first instance should evaluate the categories of the accessed personal data, duration of the access and whether the access to personal data relies on a legitimate purpose.
[1] Within this text, for the purpose of a gender-neutral approach the term “their” is used to reference “his/hers.”
