Electronic Transactions Law, personal data: limits on access, disclosure, collection and use

Law No. 20 of 2014 on Electronic Transactions was issued on 11 February 2014. Under Article 46, the Law takes effect from the date of its publication in the Official Gazette. Article 32 bars governmental bodies, agencies, public institutions, companies, non-governmental bodies and their employees from unlawfully accessing, disclosing or publishing personal data registered in electronic processing records or systems.

The data Article 32 protects relates to positional affairs, personal status, health status or elements of the financial disclosure of persons. Article 32 lifts the bar where the person concerned or a legal representative approves, or where a reasoned judicial statement allows the access, disclosure or publication. Article 32 requires those bodies to state the purpose of collecting the data and to collect it within the limits of that purpose.

Article 35 bars those bodies from collecting, registering or processing such data by illegal methods or without the consent of the person concerned or a representative. Article 35 also bars those bodies from using the registered data for purposes other than those for which it was collected. Article 35 requires those bodies to verify the accuracy of the data and to complete and update it regularly.

Article 35 requires those bodies to take appropriate measures to protect the data against loss, damage, disclosure, replacement with incorrect data and the addition of untrue information.