Protection of personal data in criminal law

The protection of personal data is closely related to constitutional law, administrative law, civil law and criminal law. The subject of this study is limited to the protection of personal data under criminal law. The main purpose of this study is to examine the types of crimes in the Turkish Penal Code No. 5237 (TPC) that are intended to protect personal data and to contribute to the doctrine on this subject. In order to make a comprehensive evaluation of the types of crimes under the TPC, the first part primarily discusses the conceptual framework related to the subject, explains the scope and legal nature of the right to protection of personal data in the light of the doctrine of protection of personal data, and then discusses the international regulations that constitute the source of the regulations in Turkish Law and the development of the norms in the national laws of other countries and Turkish Law in the historical process. The Law No. 6698 on the Protection of Personal Data (LPPD), which regulates the procedures and principles regarding the protection of personal data, is discussed in the second part, especially in terms of criminal law, as it is one of the main reference points in the implementation of the aforementioned crime types. In the third part of the study, the relevant types of crimes in the Turkish Penal Code are analyzed. It has been determined that after the enactment of the LPPD, the criticisms that these crime types are contrary to the principles of certainty and legality have come to an end, but new discussions have emerged regarding the conduct elements of these crime types. In our opinion, the discussions on whether the conduct element of the offense of not destructing data (Article 138 of the TPC) also includes the cases of not anonymizing and not deleting data stem from the legal regulations. In order to resolve this debate, the acts of not deleting and not anonymizing data should be added as optional acts to Article 138 of the TPC, which regulates the crime of not destructing data. Although opposite views exist in the doctrine, we believe that, it is not necessary to have a data processing act in terms of the LPPD to conclude that the conduct elements of the offences of recording personal data (Article 135 of the TPC) and giving, disseminating or orbtaining personal data (Article 136 of the TPC) have been realised. Whether there is an act in terms of the LPPD is an issue that must be taken into consideration only during the evaluation of justification defenses.