Recommendations on information security, personal data protection and processing of biometric data

Information security has become one of the vital concepts which has gained importance together with the emergence of the concept of information society. As far as personal data is concerned, all public and private sectors collect, process and use personal data. In Turkey, the conditions and rules for processing the personal data are regulated by the Protection of Personal Data Act (Kişisel Verilerin Korunması Kanunu "KVKK") Numbered 6698. Protection of Personal Data Act (KVKK) was adapted from the 95/46 numbered Directive on the Protection of European Union Data issued by the European Union; but the EU Directive was updated on May 25, 2016 with the entry into force of the 2016/679 numbered General Data Protection Regulation ("GDPR"). It would be beneficial to emphasize that since Turkey's personal data legislation is adapted from EU regulations, the personal data law needs to be updated. KVKK regulates the rules, conditions and punishments regarding the processing of personal data. General rules are determined within the context of KVKK. KVKK does not have as detailed provisions as GDPR. More detailed provisions will be regulated by the secondary law. Personal data are generally divided into personal data and sensitive personal data. Biometric data, which has the characteristic of a sensitive data, has been one of the most frequently used techniques recently. What's more, it is also important to process and store biometric data through technically sophisticated systems as well as legal regulations. The aim of this study is to propose recommandations for protecting the personal data in the ideal level and determine the gaps in the existing regulations. Proposal will be given regarding enhancements, suggestions for personal data including biometric data protection in Turkey, as well as defining the risks and the vulnerabilities in this field.