The Data Protection Board (“Board”) has recently announced its decision numbered 2020/481 (“Decision”) on its website, providing its view on the right to be forgotten. The Board has defined “right to be forgotten” as a request for delisting results displayed on a search engine when an individual’s name and surname is searched therein. The Board has also determined the criteria it will take into account in reviewing cases concerning right to be forgotten requests.
The Board has highlighted that data subjects can lodge complaints before the Board or initiate legal proceedings directly if their delisting requests are rejected or left unanswered by search engines.
Board`s Legal Assessment on Right to Be Forgotten
The legal grounds for a right to be forgotten under Turkish law was listed under the Decision as article 20 (3) of the Turkish Constitution regulating the right to personal data protection, articles 4, 7, and 11 of the Personal Data Protection Law no. 6698 (“PDPL”), and article 8 of the Regulation on Deletion, Destruction, or Anonymization of Personal Data. In this context, the Board has emphasized that although right to be forgotten is not explicitly regulated under Turkish law, sufficient legal grounds exist for its recognition.
Search Engine Operators as Data Controllers
The Board has concluded that activities performed by search engines are data processing activities as search engines determine the purposes and means of the processing of data they collect from the internet. The data processing activities performed by search engines are listed in the Decision as collecting information from the internet in an automatic, continuous, and systematic manner, collecting, saving, and organising such data by way of indexing algorithms and storing the same on their servers, disclosing the said data in certain cases and presenting the same to their users. In light of these considerations, the Board concluded that search engine operators are data controllers as defined under the PDPL.
Board’s Criteria for Reviewing Right to be Forgotten Requests
The Board has clarified the assessment criteria it will use in reviewing delisting requests by publishing a guidance document. Accordingly, the Board will primarily consider 13 criteria in right to be forgotten cases, including whether the data subject plays an important role in public life, whether the subject of the search results is a child, whether the original content involves data processed for journalistic purposes, whether the data is up-to-date, and whether the information causes prejudice to the data subject. The assessment criteria are generally in line with the Article 29 Working Party's Guidelines on the Implementation of the Court of Justice of the European Union Judgment on Google v. Costeja Case.
The Importance and Connotations of the Decision
The right to be forgotten had already been recognized under Turkish law with the decisions of the Constitutional Court and the Court of Cassation.1 In this respect, the Board’s decision is not unexpected or surprising. However, the fact that the Board has adopted a resolution specifically for the right to be forgotten and identified the assessment criteria for the same confirms the expectation that the Board will enforce right to be forgotten directly within the scope of the PDPL and demonstrates the Board’s intention to enforce this right rather aggressively. This will allow individuals to exercise their right to be forgotten without resorting to litigation and simply by conveying their requests to the search engine operators first and then filing complaints with the Board if their requests are rejected or left unanswered.
1Decision of the Constitutional Court with application no. 2013/5653 and dated 03.03.2016, decision of the Court of Cassation Assembly of Civil Chambers no. 2014/4-56 E., 2015/1679 K. and dated 17.06.2015.
