Restrictions In the Personal Data Protection Law: An analysis within the framework of EU practice

This study aims to comprehensively examine the exemption regime stipulated in Article 28 of Law No. 6698 on the Protection of Personal Data, thereby revealing to what extent and under which criteria the right to protection of personal data can be restricted. These exemptions, which suspend the obligations and rights set forth in Law No. 6698, are structured to provide both full and partial exemptions. Moreover, Article 28 of Law No. 6698 regulates the pursuit of balance between the right to protection of personal data and other fundamental rights and freedoms, as well as certain obligations incumbent on the state. By examining the scope and practical outcomes of the exemption provisions contained in Article 28, this thesis seeks to determine the extent to which they align with both national and European Union (EU) legislation. Within the scope of the study, the regime of limiting fundamental rights and freedoms is initially addressed. Subsequently, the way exemption provisions are handled within the general framework of Law No. 6698 and the General Data Protection Regulation (GDPR) is presented. In addition, full and partial exemption provisions are discussed under separate headings in turn. This plan offers a systematic perspective on the nature of each exemption provision and the circumstances under which it may be applied. Throughout the study, judicial decisions and administrative authorities' rulings on the interpretation and implementation of these provisions are also examined. Accordingly, both theoretical and practical aspects of how the exemption provisions function have been brought to light. The methodological framework of the study is largely based on comparative law. In this regard, the consistency of Article 28 of Law No. 6698 with the relevant constitutional principles—particularly proportionality, non-violation of the essence of the right, and legality criteria found in the Constitution's regime for limiting fundamental rights and freedoms—is questioned. Meanwhile, EU regulations, especially the General Data Protection Regulation, are analyzed to determine how similar exemptions are envisaged and the restrictions under which they are applied. By also placing established exemption criteria in EU law and the Court of Justice of the EU case law under scrutiny, it is revealed where Turkish and EU law converge and where they diverge. Thus, concrete findings concerning the extent of compliance with EU legislation, which served as the main reference in the preparation of Law No. 6698, are presented. One of the most significant findings of this thesis is that the scope of activities subject to full exemptions in Law No. 6698 is arranged very broadly and with insufficient clarity. In this regard, the way the exemption addressing activities involving individuals themselves or their family members is regulated may pose a risk of excessively interfering with private life for the purpose of personal data protection. Personal data processing activities of public institutions that have a preventive, protective, or intelligence nature are exempted from the law through broad concepts, thus narrowing individuals' avenues for legal remedies. Additionally, although comprehensive exemption is granted in Law No. 6698 for judicial proceedings, it is observed that certain data protection measures can still be applied in EU law, provided that the independence of the judiciary is respected. The Personal Data Protection Board's approach, which seeks to narrow the scope of the exemption, occasionally risks causing a disproportionate restriction on judicial independence and the exercise of the right to defense. The same issue applies to official statistics and scientific research exemptions. Under EU law, certain data security measures required by the principles of legality and proportionality, as well as certain rights that remain outside the exemption, narrow the exemption's scope. Turkish law, however, adopts a stricter exemption regime in this regard. Regarding partial exemptions, it can be argued that the exemption for the processing of personal data in order to prevent or investigate crime largely applies to operations carried out by law enforcement, although there are no clear criteria for this. The exemption concerning disclosure activities is also regulated in a manner that significantly differs from EU regulations. On the other hand, the scope of the concept of disclosure has been restricted through the Board's case law. It can further be stated that the exemptions introduced for supervision, regulation, and disciplinary processes in public institutions and organizations, as well as for the protection of the state's economic and financial interests, do not have clear boundaries regarding how they will be applied or which protective measures must be in place. In light of all these findings, the study concludes that the scope and limits of Article 28 should be made more compatible with EU regulations. Primarily, the legal framework for which activities are subject to full exemptions and which are subject to partial exemptions should be more detailed and precise. As is the case in EU law, rather than entirely removing individuals' rights via a categorical exemption, such rights should be restricted based on proportionality. It is underscored that data controllers, especially in areas involving national security, law enforcement, and judicial activities, should be subject at least to a minimum level of oversight. Drafting exemptions in line with the criteria of clarity, predictability, and proportionality would better reconcile the fundamental rights of individuals with the legitimate data processing activities of public institutions. Indeed, the EU approach requires limited application of both full and partial exemptions, backed by additional safeguards. In conclusion, this study shows that the broad interpretation of exemptions in Article 28 of Law No. 6698 may significantly weaken the protection afforded to the right to personal data. Since, the exemption regime could disable many effective protective mechanisms, it is advisable for both legislative amendments to be made and additional criteria to be introduced through the judiciary and the Personal Data Protection Board. Thus, it will be possible to establish a balance between the public interest and the protection of fundamental rights, as well as to enhance the compatibility of Law No. 6698 with EU legislation.