Turkish Data Protection Authority's Decision on the Statute of Limitations for the Complaints

Article by Ertuğrul Can Canbolat, Baran Can Yıldırım, and S. İrem Akin

INTRODUCTION

The Turkish Data Protection Authority ("DPA") published on 13.02.2019 a decision¹ clarifying the statute of limitations for the complaints to be lodged to the DPA in cases where a data processor rejects a data subject's request as to his or her personal data or does not respond at all within 30 days.

Article 13 of the Law No. 6698 on the Turkish Personal Data Protection ("Data Protection Law") provides the data subjects with the right to submit requests to the concerned data controller relating to the enforcement of the Data Protection Law. These requests, among others, may be about being informed whether or not his/her personal data have been processed or about requesting the erasure or destruction of such data.

As the same article suggests, upon such request, the data controllers are obliged to conclude these requests as soon as possible and within 30 days at the latest. The data controllers are also given the option to reject these requests so long as it is accompanied by the reasons explaining the rejection (which may be subject to a review by the DPA).

In addition, Article 14 regulates another mechanism which enables the data subjects to file complaints to the DPA in relation with these applications made to the data controllers. This mechanism is known as the complaint remedy which cannot be applied without exhausting Article 13, i.e. application to the data controller.

According to Article 14, the data subjects are entitled to file complaints to the DPA in cases where the application made pursuant to Article 13 is (i) rejected, (ii) responded insufficiently or (iii) not responded in 30 days. The durations determined for these complaints are provided in Article 14/1 as "within 30 days following the date he/she learns the reply of the data controller and in any event, within 60 days following the date of application."

However, the DPA noted that this provision led to ambiguities and confusion among data subjects. Therefore, the DPA felt the need to clarify the issue regarding the complaint mechanism and made the mentioned public announcement. The decision clarifies the issues as follows:

• In case the data controller responds to the data subject's request, data subjects can lodge a complaint to the DPA within 30 days following the date the response is receipt. In this event, the 60-day period is not applicable.
• The 60-day period is applicable if the data controller fails to respond to the request made through the application of the data subject.
• Data subjects are not under obligation to wait for the respond after 30-day period is passed. In such situation, data subjects may file a complaint to the DPA within 60 days following the date of their application and not within 30 days after the belated respond.

Footnote

1. https://www.kvkk.gov.tr/Icerik/5358/Kamuoyu-Duyurusu