The concept of customer secret and the protection of this secret within the framework of the risk center's activities

Pursuant to the Banking Law, personal data of bank customers must be kept confidential, and such data may only be disclosed with the explicit consent of the customer or under exceptional circumstances expressly provided by law. Article 73 of the Banking Law prescribes criminal sanctions in cases of breach, while at the constitutional level, the protection of private life is safeguarded as a fundamental right. The Law on the Protection of Personal Data similarly treats customer information as sensitive data, regulating its processing and disclosure through the principles of consent, proportionality, and purpose limitation. In this context, the Risk Center, operating under the auspices of the Banks Association of Turkey, serves as a credit information system that consolidates credit and debt data, encompassing not only banks but also factoring, financing, and leasing companies. The Risk Center plays an important role, from evaluating personal creditworthiness to ensuring the resilience of the financial system. The first part of the study examines the concepts of client confidentiality and the Risk Center, while the second part addresses the operational issues encountered in the functioning of the Risk Center. The analysis further evaluates the legality of its practices within the framework of relevant provisions and national legislation, accompanied by an analysis of international credit information systems. Finally, the final section puts forward suggestions for legal and technological oversight mechanisms, as well as improvement strategies to address identified shortcomings and future developments.