Within the scope of the Law No. 6698 on the Protection of Personal Data ("Law"), the Turkish Republic Identity Number ("T.R. ID Number") information of individuals is not included in the category of sensitive personal data, but rather is evaluated within the scope of identity data in the general category of personal data. However, in practice, the direct processing of the T.R. Identity Number data while the same data processing purpose could be achieved by processing different data has been subject to criticism due to the fact that the T.R. ID Number is a type of data that can provide access to other personal data of the data subject.

It is without doubt that the processing of T.R. ID Numbers should be approached with particular sensitivity. Indeed, the Personal Data Protection Board ("Board"), in a recent decision1 on the processing of the T.R. ID Number in the mobile application of the data controller who provides meal card services, evaluated that although the T.R. ID Number is included in the general category of personal data, it is more important than other personal data of general category and may cause greater damages in case of a data breach for the data subjects. In the relevant decision, it was determined that the same purpose could be achieved by processing other data that do not restrict as much rights of the data subjects without processing the T.R. ID Number, thus, the principle of being related, limited and proportionate to the purpose for which personal data are processed, which is one of the general principles specified in the Law, was violated.

Following the fact that the T.R. ID Number is directly processed by data controllers in many cases in violation of the general principles of the Law, although different methods are possible in practice, and the increase in criticisms and complaints made in this direction, the Personal Data Protection Authority ("Authority") published the Guideline on the Processing of Turkish Republic T.R. ID Numbers ("Guideline") on 16 January 2024 in order to inform the public about the issues that should be considered in the processing of the T.R. ID Number. You can access the Guideline here.

In the Guideline, it has been determined that the T.R. ID Number is official, unique and unchangeable and that it is preferred to be processed by data controllers since it provides convenience in accessing other personal data of the data subjects. However, in parallel with the Board's decisions, it is assessed that although the T.R. ID Number is not among the sensitive categories of personal data, it is likely to have negative effects on the data subjects due to its nature that enabled access to other related personal data, and therefore, it has a higher importance than general categories of personal data, even though it belongs to the very same category.

In the Guidelines, the principle that personal data should be related, limited and proportionate to the purpose for which they are processed, which is one of the general principles under Article 4 of the Law, is explained, and it is assessed that while it was possible to achieve the same purpose by processing other personal data, the processing of the T.R. ID Number would constitute an intervention that further limits the right of the data subjects to request the protection of their personal data and would violate the principles of necessity and proportionality. Accordingly, in the Guidelines, while the purpose of verifying the identity of a person in a mobile application can also be achieved with a phone number, the processing of the T.R. ID Number for verification purposes is exemplified as contrary to the principles of necessity and proportionality, and it is emphasized that methods that interfere less with the right to protection of personal data of data subjects, if any, should be preferred in the processing of the T.R. ID Number.

In the remainder of the Guideline, in order to provide guidance, the cases where the processing and submission of the T.R. ID Number for data processing activities to be carried out is legitimate on the condition that it is clearly stated in the law are listed below.

Cases where the processing of the T.R. ID Number is stipulated

Cases where the submission of the T.R. ID Number is stipulated

Issuance of Invoices for Goods and Services

Shareholders' Participation in the General Assembly of a Company

Order and Cargo Delivery

Distance Contracting

Delivery of Postal Shipments

Voting in General and Local Elections

Complaint Applications to Intermediary Service Providers in Electronic Commerce

Voting in the Organ Elections of the Union of Chambers and Commodity Exchanges of Turkey and Commodity Exchanges

Sending Commercial Electronic Messages by Tradesmen

Voting in Trade Union Elections

Filing a Complaint to the Ministry of Trade Regarding Commercial Electronic Messages by Natural Persons

Notification of the Identity of the Trade Union Representative to the Employer

Registration in the Trade Registry and Registry Certification

Identification Procedures Performed by the Notary

Within the Scope of Local and General Elections, Suspension of Voter Lists, Sharing with Political Parties Qualified to Run for Election

Identification Procedures in Health Service Providers

Filing Enforcement Proceeding Requests

Identification and Notification of the Responsible Operators of Private or Public Accommodation, Recreation, Care and Treatment Facilities, All Workplaces for the Purposes of Trade and Art and Student Dormitories, as well as those who work and reside in such places; Authorized Supervisors of Public Offices; Identification and Notification of the Identities of Those Who Stay, Work or Change Their Residence Permanently or Temporarily in Dwellings

Legal Transactions Performed at Notary Public

Electronic Payment Services

Registration in the Land Registry

Identity Verification Activities in the Electronic Communication Sector

Petitions for Filing a Lawsuit, Appeal, Appeal, etc.

Betting on Sports Competitions and Winning Jackpots

Keeping Family Registers

Winning Jackpots in National Lottery Drawings

Divorce and Annulment of Marriage

Authorization of Law Enforcement Officials to Ask for Identity

Identifying Documents Issued to Natural Persons Identity

Verification with Biometric Methods in Private Hospitals

Sharing of Identity Information by the Ministry of Interior within the scope of Law No. 5490

Identity Sharing System

"Use of Code White" by Physicians and Healthcare Workers

Transactions of Insured Persons within the Scope of Social Insurance and General Health Insurance

Trade Union Establishment

Airline Ticket Issuance

Scheduled/non-scheduled passenger transportation and ticketing on highways

Obtaining and Renewing Authorization Certificates for Cargo Transportation on Highways

Ticketing for Travel, Events and Sports Competitions

Mass Customer Acceptance within the Scope of Salary Payment

Prevention of Laundering Proceeds of Crime

Data Sharing among the Members of the Turkey Risk Center of Banks Association

Number Porting

Working or being a Member in Sports Halls/Facilities


Footnote

1. https://kvkk.gov.tr/Icerik/7782/2023-1430

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.