Constitutional Court Decision on Violation of Rights Due to Lack of Effective Investigation
The Constitutional Court (‘CC’) once again emphasised the scope and importance of the right to protection of personal data with its decision dated 13.02.2024 and application number 2020/36976.
The application concerns the allegation that the right to request the protection of personal data has been violated due to the lack of an effective criminal investigation into the complaint of unlawful seizure of personal data.
The applicant filed a criminal complaint to the Chief Public Prosecutor’s Office with the allegation that his employer, who terminated his employment contract, examined his account movements without the applicant’s knowledge and consent in order not to pay his labour receivables, and claimed that his employer accused him of obtaining unfair gains and therefore examined his bank and credit card account information.
The applicant stated that the persons to whom he had made money transfers had been identified and called by his employer and that he had asked them for what purpose they had made the money transfers and submitted the necessary information of the person he wanted to be heard as a witness to the Chief Public Prosecutor’s Office. The applicant stated that his employer had also filed a criminal complaint against him and that his employer had requested the examination of an account movement belonging to the applicant by stating the name of the bank, the amount and the date, but that it was not possible for the employer to know the details without access to this information.
The Chief Public Prosecutor’s Office stated that the mere disclosure of personal data to others by means of sensory organs does not constitute the offence of unlawful acquisition of personal data, and that the offence of violation of the privacy of private life may occur if the conditions are present, and decided that there is no ground for prosecution on the grounds that there is no evidence other than the abstract statement that the offence attributed to the employer has been committed.
According to the Law No. 6698 on the Protection of Personal Data (‘KVKK’), since the information must be included in a data recording system in order for the processing activity to be brought to the agenda, it can be interpreted that the approach in the KVKK is adopted in the relevant decision. However, it should be noted that, in the offence of unlawful disclosure or acquisition of data regulated under the Turkish Penal Code No. 5237, mere learning will be sufficient for the offence to occur. Therefore, it may be argued that the decision of the Chief Public Prosecutor’s Office is not appropriate.
The applicant objected to this decision, stating that the decision was made without collecting the evidence, although he presented concrete evidence, and his objection was definitively rejected by the Criminal Judgeship of Peace on the grounds that there was no error. In our opinion, the fact that the investigation authority did not investigate how the employer accessed the applicant’s account movements means that the investigation phase was not carried out effectively in the first place, and it also leads to the inability of citizens to properly exercise the freedom to seek rights regulated in Article 36 of the Constitution.
Within the scope of the matter before the Constitutional Court, the applicant stated that the relevant complaint should be examined within the scope of the right to request the protection of personal data, since the essence of the complaint is the unlawful acquisition of personal data and the lack of an effective criminal investigation into the complaint. The Constitutional Court firstly found that the application was not devoid of grounds and that the claim was admissible.
As stated in its previous jurisprudence, the Constitutional Court defines personal data as not only information revealing the identity of the individual such as name, surname, date of birth and place of birth, but also telephone number, motor vehicle registration number, social security number, passport information, personal history, photographs, images and audio recordings, health information, genetic information, hobbies, shopping preferences, people with whom the individual interacts, and all data that make the individual directly or indirectly identifiable, including but not limited to.
In its assessment, the Constitutional Court stated that everyone has the right to demand the protection of the rights attached to his/her personality and that the state must take all necessary steps to protect these rights in accordance with the fundamental aims and duties of the state regulated in Article 5 of the Constitution (‘Constitution’), the nature of fundamental rights and freedoms regulated in Article 12, the right to privacy regulated in Article 20 and other sections of the Constitution.
The Constitutional Court stated that these responsibilities imposed on the state should be interpreted in a broad manner, that it would not be sufficient to grant the right to apply for judicial remedies alone, and that an effective investigation is also among the primary duties of the state.
According to the Constitutional Court; the fact that the Chief Public Prosecutor’s Office decided that there was no ground for prosecution without taking the employer’s statement and without determining how he accessed the account movements clearly reveals that an effective investigation was not carried out.
Considering that the State violated the Applicant’s right to request the protection of personal data within the scope of the right to respect for private life by failing to fulfil its positive obligations such as establishing an effective judicial system, conducting criminal investigations, and bringing criminal proceedings against those responsible, the Constitutional Court unanimously decided to send the relevant complaint to the Chief Public Prosecutor’s Office, which issued the decision, for a reinvestigation.
