CRIME OF RECORDING PERSONAL DATA (TCK M. 135)

1. GENERAL SCOPE OF THE CRIME                 

Today, the protection of personal data is of great importance in terms of ensuring the privacy of individuals’ private lives and their personal rights. However, the recording of information that constitutes personal data can lead to the violation of many fundamental rights of individuals, primarily the privacy of their private lives.

Changes in technology, particularly the proliferation of computers, telephones, the internet, and social media, have made it easier to obtain this collected information and use it for unlawful purposes, facilitating interference with private life. The result of this era is that information belonging to individuals can be accessed not only by a limited circle but by everyone. The first regulation on the protection of personal data in Turkey was made with Law No. 5237, the 2005 Turkish Penal Code reform. Articles 135 and 136 of the Turkish Penal Code define the unlawful recording, disclosure, dissemination, and acquisition of personal data, while Article 138 defines the unlawful destruction of personal data.

Constitutional protection for personal data was provided by adding Paragraph 3 to Article 20 of the 1982 Constitution, titled “Privacy of Private Life,” through Law No. 5982 on May 7, 2010. To fulfill this constitutional obligation, the Personal Data Protection Law No. 66982 was enacted on March 24, 2016.

The unlawful processing of personal data includes:

– Recording (Article 135) – (executive action)

– Disclosing, disseminating, or obtaining such data (Article 136) – (active act)

– Failure to destroy data after the specified period (Article 138) – (omission)

Article 135 of the Turkish Penal Code qualifies the unlawful recording of personal data as a crime and provides for penalties. According to this provision, a person who records personal data relating to individuals’ political, philosophical, or religious views, racial origins, moral tendencies, sexual life, health status, or trade union affiliations in violation of the law is subject to criminal liability.

The fundamental purpose of regulating this crime is to prevent the unauthorized collection of information about individuals’ private lives and to guarantee the protection of personal data as a constitutional right.

The scope of this crime is defined by Law No. 6698 on the Protection of Personal Data, which states that any information relating to an identified or identifiable real person is considered personal data. However, information known only within a limited circle (population information, bank account information, biological samples, etc.) that is specific to the person is included in this scope. Information of a personal nature that is widely known and easily accessible is not legally included in this scope.

2. PROTECTED LEGAL VALUE           

The protection of personal data is included in the scope of privacy of private life in the 1982 Constitution; crimes related to the protection of personal data are also grouped under the heading “Crimes against persons and crimes against private life and the private sphere” in the Turkish Penal Code.

ACCORDING TO THE PREVAILING OPINION: The legal value protected under Article 135 of the Turkish Penal Code is not the personal data itself, but rather the individual’s right to privacy in general, which is related to this data.

ACCORDING TO ANOTHER VIEW IN THE DOCTRINE: Some authors argue that the value protected here is personal data itself. This is because data is directly linked to the individual’s identity, and they have the right to control information about themselves. This view is particularly consistent with the perspective of the KVKK (Law No. 6698); the individual’s “right of disposal over their personal data” is paramount.

VIEW 3 – MIXED VIEW: The protection of personal data relates to both the privacy of private life and the right to control information. Therefore, the legal value protected by the crime should be evaluated together as the right to private life + the right to dispose of personal data. This approach emerges from the joint interpretation of the provision in Article 20 of the Constitution and the section containing Article 135 of the Turkish Penal Code.

CASE LAW: The legal value protected by this crime is “the individual’s right to privacy and the right to control information” in relation to personal data. In practice, the Court of Cassation aligns closely with the mixed view.

3. BASIC ELEMENTS OF THE CRIME 

A) MATERIAL ELEMENTS      

 I. SUBJECT MATTER OF THE CRIME       

Personal data constitutes the subject matter of the crime. The concept of personal data has been defined similarly in many legal regulations. Indeed, in Article 3(1)(d) of the Personal Data Protection Law No. 6698, in line with international regulations, personal data is defined as “any information relating to an identified or identifiable natural person.” While this definition should be the basis for evaluating crimes against personal data, the explanatory memorandum to Article 135 of the Turkish Penal Code also clearly emphasizes that personal data, which constitutes the subject matter of this crime, covers all kinds of information belonging to natural persons. Looking at how personal data is defined, it is understood that legal persons are excluded from this scope.

There are two elements in the definition. These are: the data must belong to a real person, and this person must be specific or identifiable. The real person exists, and the information that makes them identifiable will constitute the subject matter of the crime.

II. ELEMENT OF THE PERPETRATOR        

Anyone can be the perpetrator of the crime of recording personal data; it is not a specific crime. The person who commits the act defined as a crime is also the perpetrator of the crime. This is defined in Article 37 of the Turkish Criminal Code.

If the crime is committed by a public official abusing the authority granted by their position, it will constitute a qualified form of the crime, requiring a more severe punishment. TCK m. 137/1-a

As with other crimes in criminal law, it can only be committed by natural persons capable of exercising free will. Legal entities do not have the capacity to act and therefore cannot be held liable as perpetrators.

Some opinions in doctrine argue that legal entities can also be perpetrators. The definition of “data processor” in Article 3 of Law No. 6698 refers to a natural or legal person who processes personal data on behalf of the data controller within the scope of the authority granted by the data controller. Although it could be interpreted that a legal entity could commit this crime, in reality, the perpetrator is always a natural person.

However, Article 140 of the Turkish Penal Code stipulates that if this crime is committed by a representative of a private legal entity within the scope of that entity’s activities, specific security measures may be imposed on the relevant legal entity.

III. VICTIM ELEMENT    

Anyone can be a victim of this crime. The real person to whom the personal data recorded in connection with the crime belongs is the victim of the crime due to the act constituting the crime.

It is argued that legal entities cannot be victims of the crime and that only natural persons can be victims. However, some authors in the doctrine argue that legal entities can be victims of the crime committed.

If the subject matter of the crime consists of documents and information kept confidential in the interest of commercial and industrial enterprises, such as trade secrets, customer and banking secrets, the crime will have been committed under Article 239 of the Turkish Criminal Code. It can be said that legal entities will acquire the status of victim if the information and documents they possess are disclosed.

IV. ACTIVE ELEMENT    

The existence of a single act is considered sufficient for the crime to be committed. The mere act of recording personal data is sufficient for this crime to be committed.

In terms of free movement and the form of movement, it is a crime that can be committed through executive action. Since the crime is completed by the commission of the executive action, it is an instantaneous crime. The crime is completed as a result of recording. No additional consequence is required beyond the act of recording personal data, which is purely a crime of action. It is not a consequential crime.

An important point to note is that the wording of the law is clear; this crime will occur as a result of the unlawful recording of personal data, not the ordinary recording of personal data. Therefore, the crime will occur as a result of the act of recording personal data carried out by circumventing the grounds for legality.

The word “record” means to write down somewhere, enter into a ledger, transfer to a digital medium, process into a database, or keep in a list or file. The act of recording these processes separately in accordance with the law completes the actus reus of the crime.

In order for personal data to be recorded, it must first be obtained. If the data has been obtained in accordance with the law, recording it does not constitute a crime. However, if someone else’s personal data is obtained unlawfully and then recorded, two separate acts and therefore two separate crimes of unlawful acquisition of data ( ) are involved: one is the crime of obtaining data under Article 136 of the Turkish Criminal Code (TCK), and the other is the crime of recording data under Article 135 of the TCK. This situation leads to the perpetrator being punished twice for the same act. However, recording data constitutes a more serious injustice that also encompasses the act of acquisition. Despite this, the crime of acquisition is punished more severely than the crime of recording, creating a controversial ground. If the data is only acquired but not recorded, disseminated, or shared, this constitutes a preparatory act and does not warrant punishment.

For the non-automatic recording of personal data to be considered a crime, this data must be recorded in an environment that is part of a data recording system. If the recording is made in a place that is not part of a systematic data recording system, it does not constitute a crime. For example, writing a person’s phone number or email address on a piece of paper or in a notebook without their consent does not give rise to criminal liability if these records are not part of a data system.

B) MENTAL ELEMENT

The mental element of this crime is intent. The law does not regulate negligent cases. Intent is defined in Article 21, Paragraph 2 of the Turkish Criminal Code as “knowingly and willingly committing the elements of the crime as defined by law.”

The perpetrator must know that the data recorded unlawfully is personal data belonging to another person. According to one view in doctrine, the perpetrator’s knowledge that recording personal data relating to another person constitutes wrongdoing should be considered in the context of fault. In terms of the awareness of wrongdoing relating to the area of fault, this statement only means that the crime can be committed with direct intent.

C) ELEMENT OF ILLEGALITY

According to the wording of the law, it is clearly stated that the act of recording must be carried out unlawfully. It can be said that if the act of recording is carried out on a lawful basis, this crime will not be committed and will therefore be lawful.

Article 20, Paragraph 3 of the Constitution states that “it shall only be committed in cases provided for by law or with the explicit consent of the person.” In short, two types of legality are accepted. These are: cases provided for by law and the explicit consent of the person.

4. QUALIFIED ELEMENTS OF THE CRIME

We will examine the qualifying elements in two categories: qualifying circumstances related to the subject matter of the crime and qualifying circumstances related to the perpetrator’s status.

A) QUALIFIED CIRCUMSTANCES RELATED TO THE SUBJECT OF THE CRIME

The subject matter of the crime is personal data, and Article 135/2 of the Turkish Criminal Code stipulates that “if the data relates to the political, philosophical, or religious views of individuals, their racial origins, their moral tendencies, sexual life, health status, or union affiliations in violation of the law, the penalty to be imposed in accordance with the first paragraph shall be increased by half.” The legislator has provided for a more severe penalty in view of the possibility of discrimination.

Article 6 of Law No. 6698, under the heading “Conditions for processing special categories of personal data,” states that certain personal information is subject to special protection. In this context, Paragraph 1 prohibits the processing of information about individuals’ race, ethnic origin, political views, religion, sect, or other beliefs, philosophical beliefs, clothing style, membership in any association, foundation, or union, health status, information about sexual life, criminal convictions, and data related to security measures, as well as biometric and genetic data, are considered special category personal data. The law prohibits the processing of such data, as a rule, without the explicit consent of the person concerned in Paragraph 2. (Paragraph 2 of Article 6 of Law No. 6698 has been REPEALED.)

Article 135 of the Turkish Criminal Code does not fully correspond to Paragraph 1 of Article 6 of Law No. 6698. Acts listed in Article 6 but not listed in Paragraph 2 of Article 135 fall within the scope of Article 135/1 of the Turkish Criminal Code.

B) QUALIFIED CIRCUMSTANCES RELATED TO THE STATUS OF THE PERPETRATOR

The commission of the offense by a public official, through the abuse of the authority conferred by their position and by taking advantage of the facilities afforded by a particular profession or trade, is expressly provided for in Article 137 of the Turkish Criminal Code. In the event that these aggravating circumstances occur, the penalty to be imposed is increased by half.

For the aggravated circumstance under Article 137/1-a of the Turkish Criminal Code to apply, it is not sufficient that the crime be committed by a public official. The public official must commit the crime by abusing the authority conferred by their position. In other words, the public official must be responsible and authorized for data processing and recording. In addition, the authorized and competent public official will also commit the crime of abuse of office. However, in terms of the relationship between the special norm and the general norm, Article 137, as a special norm, will absorb the crime of abuse of office.

5. SPECIAL FORMS OF THE CRIME

A) ATTEMPT

Attempted crime is regulated in Article 35 of the Turkish Penal Code. Attempt is defined as the situation where the perpetrator, with the intent to commit a crime, has directly commenced the commission of the crime with acts conducive to the crime but is unable to complete the crime he intended to commit for reasons beyond his control. Attempt is very rare in purely act-based crimes and crimes of omission. It is generally accepted that attempt cannot be committed in these crimes.

Attempts can only occur in cases where the act of recording can be divided, due to it being a pure act crime. Examples of attempts occurring include when the act of recording is interrupted while writing, or when the act of recording is not completed due to the recording process being spread out over time.

The unlawful acquisition of data belonging to another person is regulated as a separate crime in Article 136. This crime is completed by the act of acquisition. However, this criminal act cannot be considered within the scope of the crime of recording, as it is regulated separately. If the act of recording is also carried out by unlawfully obtaining data, it cannot be considered an attempt, but it will be considered a preparatory act.

B) PARTICIPATION

Complicity is regulated in Article 37 et seq. of the Turkish Criminal Code. Although no specific feature is envisaged for complicity, it is possible to participate in the crime in any form of complicity. According to the legal definition, each person who commits the crime together is held responsible for the crime they committed as perpetrators.

The crime of recording personal data may also be committed as an apparent specific crime. Under Article 137 of the Turkish Criminal Code, this crime constitutes a qualified offense when committed by a public official or by taking advantage of the opportunities provided by a specific profession or craft.

In the occurrence of this qualified circumstance, it is possible for a person who is not a public official or who does not have the status of a member of the relevant profession/art to participate in the commission of the crime. In such a case, if both perpetrators committed the crime together, the person meeting the conditions of special perpetration will be punished for the aggravated form of the crime, while the person who is not a public official, even though they appear to be an accomplice, will be punished for the basic form of the crime. As a result of the perpetrator’s status as an accomplice, they will be punished for the basic form of the crime.

C) CONFLICT OF LAWS

In some cases, the rules on concurrence of crimes apply to the crime of recording personal data. For example, the act of unlawfully recording personal data, as regulated in Article 135 of the Turkish Criminal Code (TCK), may also constitute the crime of violating the privacy of private life under Article 134 of the TCK. However, if there is a special norm-general norm relationship between these two crimes, punishment should only be imposed according to the special norm, TCK Article 135, and only one crime should be considered.

The crime of recording personal data may also be committed as a continuing offense under Article 43/1 of the Turkish Criminal Code. This situation arises when the perpetrator records personal data belonging to the same person on multiple occasions at different times and in accordance with the same decision to commit the crime. For example, if a person records different personal information belonging to the same person separately at different times, even though there are multiple acts, it is considered a single offense, and the penalty is increased according to the provisions for consecutive offenses. However, it is important to note that for a crime to be considered serial, each recording must be evaluated as a separate act. Otherwise, if the perpetrator records multiple pieces of personal data in a single act, the provisions on serial crimes cannot be applied.

Similarly, if the perpetrator records the personal data of multiple individuals with a single action, the same type of intellectual concurrence arises under Article 43/2 of the Turkish Criminal Code. In this case, a single penalty is imposed; however, the penalty may be subject to increase.

A distinction is made between images and sounds belonging to a person and those relating to their private life. If these data do not relate to the private sphere of life, their unlawful recording constitutes the crime of recording personal data under Article 135 of the Turkish Criminal Code.

If the images or sounds in question pertain to the private sphere, the act of recording constitutes the crime of violating the privacy of private life as defined in Article 134/1 of the Turkish Penal Code. Regardless of whether the images or sounds pertain to the private sphere, they constitute personal data. Since the unlawful recording of personal data is specifically regulated as a crime, the special norm will take precedence over the general norm in the relationship between the special norm and the general norm. Therefore, since Article 134/1 of the Turkish Criminal Code is a special norm, the principle of ” ” will apply. This is the opinion of the Court of Cassation. (Court of Cassation Decision – 12th Criminal Chamber, E. 2014/11530 K. 2015/584 T. 19.1.2015)

Similarly, the act of providing images or sounds with the victim’s consent or making them public by the victim themselves will not fall under Article 135.

6. COMPETENT AND AUTHORIZED COURT

Competent Court            :  CRIMINAL COURT OF FIRST INSTANCE

Competent Court            : THE CRIMINAL COURT OF FIRST INSTANCE WHERE THE CRIME WAS COMMITTED                                                IF COMMITTED IN MORE THAN ONE PLACE, ANY OF THESE PLACES MAY BE COMPETENT IN ACCORDANCE WITH                 ARTICLE 13 OF THE CRIMINAL PROCEDURE CODE.

7.  PENALTY

A) BASIC PROVISION

Article 135/1 of the Turkish Criminal Code stipulates that the penalty for unlawfully recording a person’s personal data is imprisonment for a term of one to three years.             

B) QUALIFIED CIRCUMSTANCES REQUIRING A HIGHER PENALTY

1. Turkish Penal Code Article 137/1-a,b;

A) The crime is committed by a public official abusing the authority granted by their position

B) The crime is committed by taking advantage of the facilities provided by a specific profession or art

The penalty is imprisonment for a term of two to five years.

2. Turkish Penal Code Article 135/2

If the personal data relates to individuals’ political, philosophical, or religious views, racial origins, moral tendencies, sexual life, health status, or union affiliations in violation of the law, the penalty to be imposed in accordance with the first paragraph shall be increased by half.

C) QUALIFYING CIRCUMSTANCES WARRANTING A LESSER PENALTY

1. VOLUNTARY ABANDONMENT

According to Article 36 of the Turkish Criminal Code: If the perpetrator voluntarily prevents the completion of the crime or the occurrence of the result, the provisions on voluntary abandonment shall apply.

Accordingly, for voluntary abandonment: It must occur before the crime is completed, The abandonment must be of their own free will, The completion of the crime or the occurrence of the result must be prevented.

Nature of the Crime under Article 135 of the Turkish Criminal Code The crime of recording personal data is considered a pure act crime (no consequence element required). The crime is completed at the moment the personal data is recorded; no result is required. Therefore, actions taken after the crime is completed may be subject to assessments similar to effective repentance ( ), but not “voluntary abandonment” (there is no specific provision for effective repentance for this crime in the Turkish Criminal Code).

OPINIONS IN THE DOCTRINE

OPINION 1: Voluntary Desistance is Not Possible. The rationale is that since the crime is completed by an instantaneous act, the crime is finished at the moment the data is recorded. Even if the perpetrator deletes the data after it has been recorded, the crime has been completed, so Article 36 of the Turkish Criminal Code cannot be applied. Those who support this view emphasize that this opinion prevails in Criminal General Law, particularly for crimes of mere act.

OPINION 2: Voluntary Desistance is Partially Possible. The rationale is that if the perpetrator has started the recording process but the data has not yet been recorded and they desist of their own accord, voluntary desistance is applicable. For example, the perpetrator starts entering data into the computer but stops halfway; they do not complete the recording.

In this case, since “completion” has not occurred, the perpetrator is not punished. Those who support this view are authors who emphasize the distinction between attempt and voluntary abandonment.

APPLICATION: In the practice of the Court of Cassation, voluntary abandonment under Article 135 of the Turkish Criminal Code is only considered possible at the attempt stage. If the data recording has taken place, voluntary abandonment is no longer applicable; deletion or destruction does not eliminate the punishment.           

 2. EFFECTIVE REPENTANCE

Effective repentance is an institution that allows for a reduction or complete removal of punishment based on certain actions taken by the perpetrator of their own volition after committing the crime. The provisions on effective repentance in the Turkish Criminal Code are specifically regulated only for certain types of crimes (e.g., theft, embezzlement, fraud, robbery, terrorist crimes, etc.). There is no such regulation in Article 135 or Articles 136-138 of the Turkish Criminal Code.

Under Article 135 of the TCK, the crime is completed at the moment the data is recorded because it is purely a crime of action.

Since there is no specific provision for effective repentance in the law, the deletion or destruction of data does not legally eliminate the punishment. However, the judge may consider the offender’s deletion of the data or compensation of the victim’s damages as grounds for a reduction in punishment under Article 62 of the TCK (discretionary reduction).

OPINIONS IN THE DOCTRINE

OPINION 1 (MAJORITY OPINION): Effective Repentance is Not Possible The rationale is that effective repentance cannot be applied unless there is an explicit provision in the law. The offender’s deletion of the data does not negate the completion of the crime; however, it may be considered a mitigating factor at the judge’s discretion. According to this view, the provisions on effective repentance do not apply to the crime of recording personal data; only a reduction may be granted.

OPINION 2: Even if not explicitly stated in the law, if the perpetrator completely deletes the data and obtains the victim’s consent, the case may be dismissed if the victim withdraws their complaint. However, this opinion is controversial because the crime of recording personal data is not subject to complaint and is prosecuted ex officio. Therefore, its practical application is negligible.

APPLICATION: In Supreme Court decisions, it is emphasized that effective repentance is not applied under Article 135 of the Turkish Criminal Code; the deletion of data can only be a reason for a reduction in the penalty. The perpetrator’s destruction of the data can only be considered by the court as grounds for good behavior or discretionary reduction.

FREQUENTLY ASKED QUESTIONS ABOUT THE CRIME OF RECORDING PERSONAL DATA

1. WHAT DATA IS CONSIDERED WITHIN THE SCOPE OF THIS CRIME?

According to the provisions of Law No. 6698 on the Protection of Personal Data, any information pertaining to an individual is considered personal data. For example, the person’s name and surname, Turkish ID number, place of birth, date of birth, workplace, education level, voice recording, photograph, fingerprint, telephone number, e-mail address, and residence address are personal data protected under this crime.

2. WHAT IS THE STATUTE OF LIMITATIONS FOR THE CASE, CAN THE SENTENCE BE SUSPENDED, AND CAN A PROBATIONARY SENTENCE OR A FINE BE IMPOSED?

A) STATUTE OF LIMITATIONS

This crime is not subject to complaint; it is investigated ex officio.

The statute of limitations period is 8 years, according to Article 66/1-e of the Turkish Criminal Code. If the case is not brought within 8 years from the date the crime was committed, the criminal case is dismissed.

B) SUSPENSION OF THE SENTENCE (HAGB)

This is when the sentence imposed on the defendant is not pronounced if the specified obligations are fulfilled. HAGB requires that the sentence imposed on the defendant be for a period of 2 years or less and that the defendant has not previously committed an intentional crime.

As a result of the HAGB decision, the defendant is subject to supervision for 5 years. During this period, the defendant must not commit any intentional crimes. If an intentional crime is committed, the sentence is announced, recorded in the person’s criminal record, and enforced.

Since the penalty under Article 135/1 of the Turkish Criminal Code ranges from one to three years, a HAGB decision may be issued if the sentence imposed by the court is two years or less and the other conditions are met.

C) CONVERSION TO A FINE

At the discretion of the judge and if certain conditions are met, prison sentences may be converted into fines. However, not every crime falls under this scope.

For a prison sentence to be converted into a fine, the crime must have been committed intentionally and the sentence must be less than one year. The defendant’s social and personal characteristics and the circumstances of the crime will be taken into account by the judge.

In the case of the crime of recording personal data, if the sentence is less than one year, the prison sentence may be converted to a fine, provided that other conditions are met. However, if the sentence exceeds one year, it cannot be converted. If the fine is not paid on time, the sentence may be converted back to imprisonment.

D) SUSPENSION OF SENTENCE

According to Article 51 of the Turkish Criminal Code, prison sentences of two years or less may be suspended if certain conditions are met. If the sentence imposed on the defendant under Article 135/1 of the Turkish Criminal Code falls within these limits, the court may suspend the sentence.

A probation period of 1-3 years is determined for the convicted person. If the person commits no crime and complies with their obligations during this period, the prison sentence is considered to have been served. In other words, the person is considered to have served their sentence without going to prison.

E) STATUTE OF LIMITATIONS (CRIMINAL STATUTE OF LIMITATIONS)

If the court imposes a sentence, there is a separate statute of limitations period for the execution of that sentence.

According to Article 68/1-c of the Turkish Criminal Code, the statute of limitations period for the execution of a prison sentence of 3 years or less is 10 years.

3. WHAT IS THE RELATIONSHIP BETWEEN THE KVKK AND THIS CRIME?

The KVKK regulates the procedures and principles regarding the processing of personal data. TCK 135 covers the criminal aspect of the violation. In other words, it is applied together with the KVKK.

4. WHAT CRIMES CAN THE CRIME OF RECORDING PERSONAL DATA BE MIXED WITH?

It is distinct from crimes such as violating the confidentiality of communications, violating the privacy of private life, and obtaining/disseminating/disclosing personal data.

5. WHAT ARE THE CIRCUMSTANCES IN WHICH THE PENALTY IS AGGRAVATED (QUALIFIED CASES)?

If the data relates to political, religious, or philosophical views, racial origin, sexual life, health status, or union affiliations, the penalty is increased by 50% (e.g., from 1.5 years to 4.5 years). This increase in penalty is due to the different nature and sensitivity of the recorded data. This is because such data can lead to discrimination between individuals. The legislator has specifically regulated this and deemed the application of increased penalties appropriate.

Furthermore, if the crime is committed by a public official through abuse of their position or by taking advantage of their profession/art, the penalty is increased by the same amount. (TCK m. 137)

If both the special (sensitive) data type and the public official element are present, the penalty will first be increased by 50%, and then a further 50% penalty increase will be applied to the increased penalty.