Offences Relating to Personal Data
Unlawfully recording, disclosing, disseminating or obtaining personal data is a criminal offence under the Turkish Criminal Code, separately from the administrative sanctions under the KVKK. In offences relating to personal data, we represent your company as the victim and conduct the defence when allegations are made against your executives and employees, in step with the KVKK processes.
What are the offences relating to personal data?
The Turkish Criminal Code makes it an offence to unlawfully record personal data, to unlawfully give it to others, disseminate it or obtain it, and to fail to destroy data after the periods set by law have expired. The KVKK also refers to the Turkish Criminal Code for these offences.
The examples most often seen in companies are a departing employee taking customer or employee lists, unauthorised persons accessing customer records and passing them on to third parties, and security camera recordings being shared unlawfully.
Do company executives bear criminal liability for a data breach?
Criminal liability is personal and requires the elements of the offence to be present in respect of the person concerned. An executive’s criminal liability is assessed according to whether they took part in the breach through their own act and their intent. The company, for its part, may face a separate administrative fine under the KVKK; the two processes run independently but affect each other.
Scope
- Handling the company’s complaint and intervention in offences relating to personal data
- Defence against allegations made against employees and executives
- Managing the criminal process together with notification and Board processes under the KVKK
- Legal measures to recover data and prevent its dissemination
How We Work
- Identifying the incident, the data accessed and the evidence
- Setting the criminal complaint or defence strategy
- Running the KVKK breach notification and correspondence with the Board in line with the criminal process
- Following the investigation and prosecution stages
- Recommendations on access rights and exit processes to prevent similar incidents
Team
Frequently Asked Questions
A departing employee took our customer list. What can we do?
This act may amount to disclosure of trade secrets and unfair competition, as well as offences relating to personal data. A criminal complaint, a preliminary injunction to prevent use of the data and claims for damages should be considered together. Since the incident may also be a data breach under the KVKK, the notification obligation should also be examined separately.
The Board has imposed a fine; will there also be a criminal case?
The Board's administrative fine and criminal proceedings are separate processes. If the Board identifies a suspected offence during its investigation, it may report it to the public prosecutor. No criminal case is brought against the company itself, but an investigation may be opened against the individuals who committed the act.
Is sharing security camera recordings a crime?
Giving recordings to third parties or spreading them on social media without a legal basis may constitute the offence of unlawfully disclosing or disseminating personal data. Sharing at the request of the competent authorities is not within this scope.
Is failing to delete data when the retention period expires also a crime?
Failure by those responsible to destroy data in the system after the periods set by law have expired is a separate offence under the Turkish Criminal Code. The retention and destruction policy must therefore actually be applied in practice.
Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meeting