The Personal Data Protection Board (KVKK) has published a new principle decision regarding the fact that almost all of us are receiving calls from unknown phone numbers for days or even months after a traffic accident.
The decision determines the responsibilities of data controllers, especially those who are employers.
Accordingly, the Board reminded the provisions of the Attorneyship Law and the Insurance Law and stated that compensation receivables can only be pursued by the lawyer who is the beneficiary or his representative, and these rights cannot be transferred to third parties. emphasized.
For this reason, the activities of damage consultancy companies, insurance adjusters or unauthorized lawyers may violate both the relevant legislation and the Personal Data Protection Law No. 6698. The Board stated that a complaint can be made to the Board about these people in accordance with Article 13 of Law No. 6698.
The principle decision also emphasized that illegally obtaining or sharing personal data may constitute a crime within the scope of the Turkish Penal Code and that these people may be filed with the prosecutor's office. (According to Article 136 of the Turkish Penal Code, illegally giving and obtaining personal data can be punished from 2 to 4 years, while in Article 137 of the same Law, the qualified form of the crime will be committed because it is committed "by taking advantage of the convenience provided by a certain profession or art" and the penalty will be increased by half.)
KVKK also mentioned the data controllers who are employers. Accordingly, it has been stated that data controllers should;
provide regular training to their employees,
limit the access rights of employees,
in this context, apply role-based access controls,
access to personal data should be recorded.
It has been stated that administrative action will be taken within the scope of the Personal Data Protection Law against data controllers who act contrary to the decision and do not take the aforementioned measures in terms of preserving personal data.
For the decision, see: https://www.resmigazete.gov.tr/eskiler/2026/07/20260701-15.pdf