Turkish Data Protection Authority ("DPA") recently published a decision regarding exercise of "right to be forgotten" on search engines in Turkey. The DPA stated in its announcement of the decision that they have evaluated the applications submitted before the DPA with regards to the requests on de-indexing web search results and within the scope of "right to be forgotten" and decided on the following:
(i) "Right to be forgotten" is evaluated within the scope of Article 20 of the Turkish Constitution and Articles 4, 7 and 11 of the Law No. 6698 on Protection of Personal Data ("DLP") along with the Regulation on Erasure, Destruction or Anonymization of Personal Data.
(ii) Individuals' right to request prevention of broadcasting contents concerning them when their names and surnames are searched on web search is considered as "de-indexing request",
(iii) Web search engines should be considered as "data controllers" within the scope of the DPL,
(iv) Web search engine operator finds the information broadcasted on the internet automatically, systemically and regularly and then saves such information through their indexing programs and organizes and lists these information as web search results, disclose such data in certain circumstances and provide its users and thus; these activities should be considered as "data processing activity" per DPL,
(v) Individuals may primarily convey their de-indexing requests to the search engines and they (a) may file a complaint before DPA in case search engines decline or do not respond to these requests and (b) also may apply to available judicial remedies,
(vi) The form of application, information and documents to be requested from the individuals for the foregoing applications will be determined by the search engines,
(vii) While evaluating the de-indexing requests, a balance test should be made between the data subject's fundamental right and freedoms and public interest and the criteria published by DPA should also be considered in each case and
(viii) Search engines should take necessary steps in order to ensure that Turkish citizens are able to use communication channels with regards to conveying their requests within the scope of this decision and use their right to be forgotten through the websites.
In addition to several Turkish law precedents relevant to this matter, the DPA also referred to the European Court of Justice's Costeja decision of 2014, Article 29 Working Party's Opinion on the Guidelines on the Implementation of the Court of Justice of the European Union Judgment on Costeja Case as well as Article 17 of the GDPR which governs "Right to erasure ('right to be forgotten')".
The DPA's announcement includes a guidance document setting out the criteria to be taken into account while evaluating the requests for exercising right to be forgotten, which is generally in line with Article 29 Working Party's Opinion on the Guidelines on the Implementation of the Court of Justice of the European Union Judgment on Costeja Case.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
