INFORMATION NOTE ON THE SUMMARY OF THE DECISION OF THE PERSONAL DATA PROTECTION BOARD DATED 02/12/2021 AND NUMBERED 2021/1218

---

15 June 2022

You may find below our notes on the Summary of the Decision of the Personal Data Protection Board dated 02/12/2021 and numbered 2021/1218 Regarding "The data subject employee not being informed by the data controller residing abroad, of the personal data processing activities carried out about him/her, the personal data of the data subject being processed unlawfully by the data controller in the period after April 2021".

Board’s Findings:
The following points under the abovementioned decision of the Personal Data Protection Board (“Board”) are of importance:

• If the data controller and the data subject are residents abroad, it is sufficient to inform the data subject in accordance with the General Data Protection Regulation (“GDPR”), the primary personal data protection regulation of the European Union. However, considering that the data subject has left his/her job in London and started to work in the liaison office of the data controller in Istanbul, he/she must be informed by the data controller with regards to the data processing activities in accordance with the Personal Data Protection Law numbered 6698 (“PDPL”), in addition to the information provided within the scope of GDPR obligations.
• As the data controller has legitimate interest in disclosing that it has a liaison office in Turkey and competent and qualified employees are being employed in this office, it cannot be concluded that disclosure of personal data of the data subject on the website of the data controller harms the fundamental rights and freedoms of the data subject. However, after the employment relationship between the employee and the employer has been terminated, the personal data of the employee, cannot still be kept on the website of the employer; as this situation may harm the freedom of work and freedom of contract of the relevant employee and his/her job applications may be adversely affected by this situation.
• It should be accepted that the data subject's request for information from the data controller as to whether his/her data being processed unlawfully means that the data subject has withdrawn his/her explicit consent for the disclosure of his/her name and photograph on the  website of the employer.

Conclusion: With this decision, the Board has once again drew attention to the fact that fulfilment of their obligations under GDPR by the data controllers, will not be deemed as they have also fulfilled their obligations arising from PDPL, including the obligation to inform; so, they are obliged to take the necessary actions under the PDPL as well. In addition, although the Board generally draws attention to the necessity of explicit declaration of intent in the implementation of the PDPL, it has stated that it is not necessary to seek a clear declaration of intent for the data subjects to withdraw their express consent. Accordingly, a request for information regarding the data of a data subject that he/she believes has been processed unlawfully will be interpreted as withdrawal of all previous explicit consents given to the data controller by the relevant data subject.