Bay Matbaa Printing Technologies Center Industry and Trade Joint Stock Company (BAY MATBAA) values the security of personal data. In this context, we find it appropriate to inform all stakeholders about the "Personal Data Protection Law" created for the protection of individuals' fundamental rights and freedoms and the protection of personal data.
The Personal Data Protection Law No. 6698 was published in the Official Gazette on April 7, 2016, and entered into force. This law includes general principles to be followed in the processing of personal data, conditions for the processing of personal data, and the rights of data subjects. The purpose of this law is to "regulate the procedures and principles that real and legal persons processing personal data must comply with and to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data."
General Information About the Personal Data Protection Law
Personal data is defined as "any kind of information related to a specific or identifiable real person." The term "any kind of information" refers not only to information that allows the exact identification of an individual, such as the individual's name, surname, date and place of birth, but also includes information about the individual's physical, family, economic, social, and similar characteristics.
Sensitive (special category) personal data is a special type of personal data. The legislator, thinking that this information could be used in a way that could lead to discrimination against individuals, has regulated the processing conditions of sensitive personal data more strictly. These data include information about individuals' race, ethnicity, political opinion, philosophical belief, religion, sect, or other beliefs, appearance and clothing, association, foundation, or union membership, health, sexual life, biometric data, or data related to criminal convictions and security measures given about them.
Processing of personal data includes all kinds of transactions carried out on the data, such as obtaining, recording, storing, preserving, modifying, transferring, and inheriting.
To process personal data in a legally compliant manner, certain principles/methods must be followed. Firstly, data processing must be in accordance with the law and fairness rules. Other principles include ensuring that the processed data is accurate and up-to-date when necessary, processing the data for specific, clear, and legitimate purposes, and ensuring that the processing is relevant, limited, and proportionate to the purpose. In addition, processed data should not be stored longer than necessary for the purpose.
Conditions for Processing Personal Data
Personal data cannot be processed without the explicit consent of the data subject in principle. In order to obtain explicit consent, detailed information about the process must be provided to the data subject. However, according to Article 5 of the law, personal data can be processed without the explicit consent of the data subject in exceptional cases. These exceptions are:
- When processing is explicitly stipulated in the laws,
- When it is mandatory for the protection of life or physical integrity of the data subject or someone else, and the data subject is unable to express his/her consent due to actual impossibility or whose consent is not legally valid,
- When data processing is necessary for the conclusion or performance of a contract, provided that it is directly related to the parties of the contract,
- When it is necessary to fulfill the legal obligation of the data controller,
- If the relevant person has made it public,
- When data processing is necessary for the establishment, exercise, or protection of a right,
- When data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Sensitive personal data, other than health and sexual life, can be processed without explicit consent only if it is explicitly stipulated by the laws. Data related to health and sexual life can be processed without the explicit consent of the data subject only for the purposes of protecting public health, carrying out preventive medicine, medical diagnosis, treatment, and care services, planning and managing the financing of health services, and by persons or authorized institutions and organizations subject to the confidentiality obligation.
Obligation to Inform the Data Controller
According to the law, data controllers are obliged to inform the data subjects whose personal data they process. Within the scope of fulfilling this obligation, the following information will be provided to data subjects by our company when necessary:
- The identity of the data controller and, if any, its representative,
- For what purpose personal data will be processed,
- To whom and for what purpose the processed personal data can be transferred,
- The method of collecting personal data and its legal basis,
- The rights of the data subject.
Rights of Data Subjects
According to Article 11 of the law, individuals have been granted certain rights. Accordingly, everyone can apply to the data controller regarding the following:
- Learning whether personal data has been processed,
- Requesting information if personal data has been processed,
- Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
- Knowing the third parties to whom personal data is transferred at home or abroad,
- Requesting correction of personal data if it is incomplete or incorrectly processed,
- Requesting the deletion or destruction of personal data within the framework of the conditions specified in Article 7,
- Requesting the notification of the processes carried out in accordance with the deletion, correction, or destruction processes to third parties to whom personal data has been transferred,
- Objecting to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,
- Requesting compensation if he/she incurs damages due to the unlawful processing of personal data.
Respectfully submitted for your information."
