Right to Be Forgotten Within the Scope of Personal Data Protection Law

The Right to Be Forgotten, also known as the "Right to Erasure," has emerged and been born as a new right regarding whether individuals' past in the virtual world, especially on the internet and social media, can be removed according to their own wishes as a result of the development of the science and technology age.

The shares of individuals in the internet world, especially negative but also positive effects, affect many fundamental rights and freedoms such as the privacy of private life, the protection and development of moral existence. Only the persons to whom the relevant data belongs can benefit from this right, and therefore only the relevant persons have the right to request the deletion of their personal data to make it difficult to access or remove content shared on the internet.

Evaluation of Lawfully Processed Data Within the Scope of Right to Be Forgotten

As stated above, it can be seen that lawfully processed data may also be subject to the exercise of the right to be forgotten, for example, when the relevant data is published lawfully through any sharing on the internet, but may become unlawful due to time and changing conditions.

In this regard, as a result of the relevant data losing its currency or accuracy over time, it actually continues to exist on the internet as unlawful data, which may negatively affect the lives of people entitled to benefit from the relevant right.

European Union Court of Justice Decision

In 2014, the European Union Court of Justice addressed the right to be forgotten in the decision "Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (Google v. Spain)".

The decision briefly stated that information reached in searches on the internet search engine that is "invalid, incomplete, completely irrelevant or subsequently became irrelevant" should be blocked from access through the search engine to this personal data that exceeds its purpose.

It was mentioned that the right to be forgotten could be above the public's right to information in the privacy of private life of relevant persons in some concrete cases. In this equation, it was underlined that the privacy of private life prevails and decisions not to block access to the mentioned personal data will be lawful and valid only in cases where there is a benefit of public superiority.

Court of Cassation General Assembly Decision

In a decision made by the Court of Cassation General Assembly in 2015, it was briefly ruled that the explicit mention of the name of the victim in a criminal trial in a source violates the person's private life and that there is no superior public interest in the concrete case.

Definition of Right to Be Forgotten in Turkey

Although there is no explicit definition of this right in our country, in a 2020 decision of the Personal Data Protection Board, the right to be forgotten was stated as "the ability of the individual to request that information about their past that was lawfully published and accurate in nature be removed from access or not brought up depending on the passage of time."

Legal Regulations

With Law No. 6698 on Protection of Personal Data and the Regulation on Deletion, Destruction or Anonymization of Personal Data, the "right to be forgotten" has found its place in legal regulations.

In Article 7 of the KVKK, it is regulated that even if it has been processed in accordance with the provisions of the KVKK, if the reasons requiring the processing of the relevant personal data disappear, these data will be deleted, destroyed or anonymized by the data controller ex officio or upon the request of the relevant person.

In addition, general rules in the processing of personal data are also regulated in various provisions of the KVKK. In this context, if the data of the relevant right holders fall within these regulations, it is possible to use the application rights in the KVKK to request the deletion, anonymization, cessation of data processing activities, destruction, removal from content or cessation of data processing activities of their data, and the appropriate one can be applied.

Application Procedures

If there is a case where servers or sites collecting data on the internet store these personal data unlawfully, various regulations support the right holders to use their right to be forgotten to request the removal of their personal data.

Persons whose personal data is processed unlawfully over the internet can apply to the servers, sites or search engine owners that hold and process this data, and persons who cannot get any results in this way can apply to the Personal Data Protection Board or judicial remedies.

Criminal Sanctions

For those who do not delete or anonymize this data despite the absence of any legal basis in the processing of data, this situation has been characterized as a crime by the Personal Data Protection Authority in Article 17/2 of the KVKK, and the punishment of these crimes has come to the agenda in accordance with Article 138 of the Turkish Penal Code No. 5237.

Article 138 of the Turkish Penal Code states "Those who are obliged to destroy data in the system despite the expiration of the periods determined by the laws are sentenced to imprisonment from one year to two years if they do not perform their duties. If the subject of the crime is data that must be removed or destroyed according to the provisions of the Criminal Procedure Code, the sentence to be given is increased by one fold." and imprisonment is foreseen for those who cause the violation.

Conclusion

The right to be forgotten is an important right that increases individuals' control over personal data in the digital age. This right, protected by both national and international regulations, aims to prevent data shared in the past from negatively affecting individuals' private lives over time. The KVKK and related regulations provide the necessary legal framework for the exercise of this right and foresee deterrent criminal sanctions against violations.