Av. Sevcen CAN & Av. Yasemin ÇORAK
In our previous article, we explained the purpose and scope of LPPD and the role of Turkish Data Protection Authority in protection of personal data (Please see…). Before starting to evaluate LPPD, in this article, the definitions of some concepts in the Law should be explained;
Personal data: Any information relating to an identified or identifiable real person. Thera are basically two criterias that are used to differentiate personal data from non-personal one; the data must be related to a person and that person must be identified or identifiable.
Data subject: The natural person whose personal data is being processed. If personal data relating to a legal person identifies or makes identifiable a natural person, these data are protected under the LPPD as well.
Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data registry system. There is no difference between public legal persons and private legal persons in terms of being data controller.
Processing of personal data: Any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means.
Explicit consent: Freely given, specific and informed consent.
Anonymizing: Rendering personal data impossible to link with an identified or identifiable natural person, even through matching them with other data.
Data registry system: The registry system which the personal data is registered into through being structured according to certain criteria.
In our another article, we explain the key principles in processing of personal data;