The whole thing goes: The future’s not set. There is no fate but what we make for ourselves.* What is the most private place in your life? Your bedroom? Your e-mail or social media accounts? What about your car, pharmacy in your neighbourhood, your back garden? Can you disappear for a while without letting anyone know and do whatever you want?
In today’s world, all human-specific situations and actions stated above have become impossible; loneliness of human beings, being the subject of both philosophical and sociological discussions, is bundled up even more with cables. It is, in fact, sufficient to create the perception that we are not so distant from the idea of machines controlling human beings as seen only in fantastic or post apocalyptic films.
For now, let’s have a brief overview of the issue of personal data in Turkey, which is not so distant from science fiction films, in the light of the latest decision of the Constitutional Court.
Although Turkey still does not have a law with regards to the protection of personal data, Courts, acting more quickly than the Turkish legislation which cannot keep up with the pace of our age, have already started creating case laws. The last example to this is the Constitutional Court’s ruling of 25.12.2014 on cancelling the phrase in the paragraph related to sharing health data in Article 78 of the Social Security Law. The grounds for the said ruling were published in the Official Gazette on May 23, 2015.
Article 78 of the Social Insurance and General Health Insurance Law No. 5510 was as follows;
“Obligation to record and notify and authority to control of the healthcare service providers
ARTİCLE 78 - All of the health - care service providers in contract with the Institution are obliged to send the information of each and every individual receiving health - care service, as stipulated in contractual provisions, in accordance with the stated methods and term, on electronic medium or in written form. Health - care service prices requested without submitting such information shall not be payable until the said information is sent.
Confidentiality of health information of the universal health insurance holders and their dependants is fundamental. How the health information shall be protected and those individuals whose health information shall not be revealed due to national security shall be determined by the Ministry, upon proposal of relevant ministries. (Appended sentence: 17/4/2008 - 5754/66th Art.) How the health information of such individuals and groups shall be kept will be determined by a regulation to be prepared by receiving opinions of concerned organizations.
The Institution may examine books, documents and information, and may request presentation of such, kept by employers, health - care service providers and other real and artificial persons, regarding application of universal health insurance provisions.
The Institution has the authority to control services and transactions carried out by health - care service providers regarding their duties laid down in this Law. The Institution may use this authority through the personnel charged with duty or by purchasing service from public institutions or special institutions.”
15th Division of the State Council of the Constitutional Court examined the application requesting the cancellation of paragraphs 1 and 2 of the above-mentioned Article on grounds of Article 21, Article 72, Article 133, Article 204 of the Constitution and cancelled the statement in Article 78/2 which reads “How the health information shall be protected and those individuals whose health information shall not be revealed due to national security shall be determined by the Ministry, upon proposal of relevant ministries. (Appended sentence: 17/4/2008 - 5754/66th Art.) How the health information of such individuals and groups shall be kept will be determined by a regulation to be prepared by receiving opinions of concerned organizations” and concluded the same.
The main reason behind the cancellation of said paragraph is that the draft law has not been passed yet. In Turkey, issues of protection, process and storage of personal data, the borders and contents of which increase every day, are attempted to be resolved, not with reference to an existing law, but on the basis of the provisions set out by the Constitution or the Penal Code, both of which substantially remain insufficient.
Another arbitrary remedy found by the law maker is to compensate the drawbacks of the laws by introducing regulations. Regulations, which change the purpose by intervening in the spirit and wording of fundamental rights and liberties as defined and border lined by the Constitution or international agreements, or make it difficult to practice and interpret the fundamental rights and liberties with prejudice to principle of proportionality, are made by the executive organ, namely the Council of Ministers, or governmental entities, instead of the law maker.
As stipulated by Article 13 of the Constitution, fundamental rights and liberties may be restricted only by law. In other words, the fact that the executive organs or governmental entities, acting as law maker, define the borders of fundamental rights or determine how said rights are exercised will conflict the constitution.
The Constitutional Court, with its decision no 2013/122 E and 2014/74, reminds the definition that “personal data is any information, which makes it possible to identify directly or indirectly that person, including name, surname, date and place of birth, telephone number, drivers license plate, social security number, passport number, resume, picture, photo and audio records, finger prints, genetic information, IP address, e-mail, hobbies, preferences, contacts, memberships, family information.” Additionally, medical data, which is formed of all information recorded for a person’s physical or mental health, is regarded under the category of “sensitive” or “private” personal data, such as race, political ideas, philosophical belief, religion, religious sect or other beliefs, relations to associations, foundations or unions or private lives and all kinds of evictions and therefore is of particular importance.
When the Court examines the request of cancellation, it refers that data protection and, in fact, privacy as the main heading is a choice and subsequently a right and furthermore, knowledge mining from databases, in the light of technological developments, reaching the object of data of the received and collected data via data, in other words, increase in data mapping, more importantly, unravelling personal data for the use of large or small scale companies for commercial purposes stress out that data protection has become even more important today.
On the basis of the court’s comments, sale of personal data has become common practice today; companies pay large amounts of money to purchase such data. The World Privacy Forum anticipates that there is more than 4000 data broker worldwide today.
Large scale commercial companies, data brokers purchase information such as consumer health data, results of web surveys, lists of donators, subscriber lists of magazines or newspapers. However, methodology of law, including American Law has found a legal solution to this trade against such infringement of privacy and sale of data without the consent of the data owners/subjects or can impose sanctions. In recent years, The Social Security Institution denied the reports that health data of persons were sold in consideration of 65 thousand Turkish liras and referred to the report5 of Supreme Court of Public Accounts published in 2013 and stated that there has been no such evidence that personal data has been shared. In the said statement, the Social Security Institution expressed as follows:
“On the contrary, it is clearly evident that personal data was not included but anonymous data was shared. In health sector, anonymous medical information acts as a source of great importance in the studies such as carrying out scientific and academic studies, developing public health, identifying disease burden. Releasing this act of scientific support by presenting such anonymous data to the academicians to the public as sale of personal data indicates an understanding of biased attitude. By no means, shared information has included data such as names, identity numbers of the patients, which hospitals they went to, in which outpatient clinics they got examined, which medication they received. Supreme Court of Public Accounts has mentioned the matter in its report for the year 2013.”
If we revert to the Constitutional Court’s ruling, Article 20 of the Constitution, one of the few reference provisions for the protection of personal data, expressly and without doubt, guarantees the protection of personal data in these days the Draft Law on the Protection of the Personal Data is under parliamentary consideration.
Article 78 of the Insurance Law, the subject matter of the Constitutional Court’s ruling, states “How the health information shall be protected and those individuals whose health information shall not be revealed due to national security shall be determined by the Ministry, upon proposal of relevant ministries. How the health information of such individuals and groups shall be kept will be determined by a regulation to be prepared by receiving opinions of concerned organizations.”
As stated in the precedents of the Constitutional Court, which defines above the personal data, we have underlined the fact that medical information is deemed under sensitive information, therefore protection and storage of personal data can only be set out by law. Concept of “national security”, which appears in Article 78 and also in many other Turkish law and leaves room for circumstance, is used in this Article as well and constitutes a contradiction to “predictability” and principle of “constitutional state” which is ruled out in Article 2 of the Constitution. Principle of constitutional state implies that citizens living within the borders of a country should have their full trust in the legal system; that legal boundaries should be definite and measurable; and that persons should know and predict what penalties and sanctions they would be subject to in consequence of their actions.
Therefore, abstract terms with no clear and explicit definitions, such as national security, should not be used when drawing and limiting the boundaries of basic rights and liberties. Otherwise, arbitrariness will be inevitable in practice.
Vesting legislative power in relation to permission to share or store personal data to the Ministry of Labour and Social Security, an executive organ, constitutes contradiction to the principle of non-transferability of legislative power, as prescribed in Article 7 of the Constitution. Furthermore, share of medical information of a person is subject to the consent of that person, namely the subject of such data, by law.
Indeed, the Court nullified the second sentence of the second paragraph of the relevant provision in its decision, as reasoned above in detail and refused the cancellation of first paragraph, another provision requested to be declared void.
Paragraph one of Article 78 stipulates;
... “All of the health - care service providers in contract with the Institution are obliged to send the information of each and every individual receiving health - care service, as stipulated in contractual provisions, in accordance with the stated methods and term, on electronic medium or in written form. Health - care service prices requested without submitting such information shall not be payable until the said information is sent.”
When the court provides justification that said provision complies with the law, it refers to the duties of the Social Security in Article 3 of the Law and states that the Institution requires such medical information in order to fulfil its duties and to determine the social security policies and emphasized that this requirement is in public interest, the right to privacy is restricted for public interest and such restriction complies with the requirements of a democratic society. Having concluded that by drawing the boundaries of the authority to collect data, balance has been redressed between basic rights and liberties and public interest, the Court refused the cancellation request.
Protection, processing, storage of data and drawing the lines of data protection legislation, and most importantly, the question of ownership of data have become one of the primary current legal issues, discussed not only in Turkey today, but worldwide. Multi-national companies, in particular, also collect and process consumption habits and financial information of persons, same as governments, without the permission of the subjects.
In such international conjuncture; interpreting current laws and the constitution falls greatly to judicial organs and institutions in the countries, such as Turkey, which do not have a data protection law yet.
It appears that the refusal ruling of the first paragraph of Article 78 by the Constitutional Court, being convinced that “balance has been redressed between basic rights and liberties and public interest”, and “wishing” that the Institution will not attempt to abuse its power in relation to fundamental liberties since boundaries of the Social Security Institution’s duties and powers are established, is a naive decision lacking legal grounds.
*Terminator 2: Judgement Day (1991) directed by James Cameron
1 II. Characteristics of the Republic
ARTICLE 2 - The Republic of Turkey is a democratic, secular and social State governed by the rule of law; bearing in mind the concepts of public peace, national solidarity and justice; respecting human rights; loyal to the nationalism of Atatürk, and based on the fundamental tenets set forth in the Preamble.
2 VII. Legislative Power ARTICLE 7
- Legislative power is vested in the Grand National Assembly of Turkey on behalf of the Turkish Nation. This power may not be delegated.
3 II. Restriction of Fundamental Rights and Freedoms
ARTICLE 13-(As amended on October 3, 2001; Act No. 4709/2)
Fundamental rights and freedoms may be restricted only by law and in conformity with the reasons mentioned in the relevant articles of the Constitution without infringing upon their essence. These restrictions shall not be contrary to the letter and spirit of the Constitution and the requirements of the democratic order of the society and the secular republic and the principle of proportionality.
4 IV. Privacy and protection of private life
- Privacy of private life
ARTICLE 20- Everyone has the right to demand respect for his/her private and family life. Privacy of private or family life shall not be violated. (Sentence repealed on May 3, 2001; Act No. 4709) (As amended on October 3, 2001; Act No. 4709) Unless there exists a decision duly given by a judge on one or several of the grounds of national security, public order, prevention of crime, protection of public health and public morals, or protection of the rights and freedoms of others, or unless there exists a written order of an agency authorized by law, in cases where delay is prejudicial, again on the above-mentioned grounds, neither the person, nor the private papers, nor belongings of an individual shall be searched nor shall they be seized. The decision of the competent authority shall be submitted for the approval of the judge having jurisdiction within twenty-four hours. The judge shall announce his decision within forty-eight hours from the time of seizure; otherwise, seizure shall automatically be lifted.
(Paragraph added on September 12, 2010; Act No. 5982) Everyone has the right to request the protection of his/her personal data. This right includes being informed of, having access to and requesting the correction and deletion of his/her personal data, and to be informed whether these are used in consistency with envisaged objectives. Personal data can be processed only in cases envisaged by law or by the person’s explicit consent. The principles and procedures regarding the protection of personal data shall be laid down in law.
5 http://www.sayistay.gov.tr/rapo/kid/2013/Genel_B%C3%BCt%C3%A7e_Kapsam%C4%B1ndaki_%20 Kamu_%C4%B0dareleri/BA%C5%9EBAKANLIK.pdf