Evaluation of public institutions within the framework of legal responsibilities for the anonymization, deletion and destruction of data: The case of Aydin province

The aim of this study is to examine the public institutions operating within the boundaries of the civil administration of Aydın province in terms of data management processes, especially anonymization, deletion and destruction of data. In the study, the regulations in the Turkish legal legislation and concerning the provincial organizations of public institutions were determined and evaluated within the framework of the European Union data protection law and regulations on data security and theoretical studies carried out to ensure data security. In line with the purpose of the study, a questionnaire was applied by face-to-face interviews with administrative and technical personnel working in 103 public institutions. The findings show that public institutions have some deficiencies in terms of data management processes. It has been determined that public institutions do not fulfill their legal responsibilities regarding personal data and do not carry out any activities within the scope of anonymization and destruction of personal data. As a result of the study; It is seen that the legal regulations are not inclusive enough for the provincial organizations of public institutions, the existing policies are limited to the capital organizations in practice, the data management responsibilities are not measurably revealed, the training processes of the relevant personnel on data protection are not systematic and limited to the materials determined by the capital organizations, and risk management related to data security is not carried out. In line with the findings obtained, in order to make public institutions effective and effective in terms of data management; Suggestions were made on ensuring the confidentiality and integrity of corporate and personal data, anonymization, deletion and destruction of data, archiving of data kept in electronic environment, development of a risk-based approach, ways of storing digital data and security methods to be applied in data management processes. This study reveals the status of data management of public institutions and provincial organizations. In this respect, it is important to eliminate the deficiencies of public institutions in terms of data management and to ensure personal and corporate data security. In addition, it is envisaged that the study will set an example for similar studies to be carried out on the anonymization, deletion and destruction of corporate and personal data in the capital and provincial organizations of public institutions in the future.