The decision of the Personal Data Protection Board dated 23.12.2021 and numbered 2021/1304 ("Decision") has been published in the Official Gazette dated 20 January 2022 and numbered 31725.

Decision is about car rental companies sharing matters regarding risky customers with each other through a database. This database allows other car rental companies to view the information entered by a company about their customers, including the negative aspects regarding the use of vehicles or comments of the car rental companies, and this practice is described as "blacklisting". Decision emphasizes the joint data responsibility, which is not set forth under the Personal Data Protection Law ("PDPL") and is regulated in Article 26 of the European Union General Data Protection Regulation ("GDPR"). Accordingly, if a personal data is processed within the scope of blacklisting practices in the car rental sector in violation of PDPL, it has been decided that the car rental companies that have control over the data will be considered as joint data controllers with the software companies and that the joint data controllers will be held jointly responsible in the practices before the Authority. Consequently, possible legal and criminal sanctions for illegal data processing may be applied to all car rental companies and software companies that are considered as joint data controllers. In addition, it is envisaged that practices such as unlawful blacklisting will be terminated and necessary technical and administrative measures will be taken by the data controllers.

The "joint data controller" concept, which is not clearly regulated under PDPL, may have significant legal, criminal and administrative effects; therefore, the regulation of the "joint data controller" concept with a principle decision instead of a provision of a law is criticized in terms of law and law-making technique.

Should you have any enquires on the above, please do not hesitate to contact us. We would be happy to assist.

Kind Regards,
Güner Law Office