Writing a name in a news report, publishing a photograph, mentioning a person's illness or conviction — each of these is processing of personal data within the meaning of Personal Data Protection Law No. 6698 (“KVKK”). The question is not whether such processing takes place, but which regime it is subject to. Publishing activity may fall within the exemption in Article 28(1)(c); but the exemption is not automatic and it has a limit. This article first gives the definition and condition provisions of the Law word for word, then shows with concrete scenarios where the exemption operates in a news report and where it is cut off.
Definitions: what counts as personal data (Article 3)
Article 3(1)(d) of KVKK: “Personal data: means any information relating to an identified or identifiable natural person.” The word “identifiable” is vital for reporters: even if you do not write the name, if the details you give make the person recognisable, that information is personal data. The phrase “the head physician of the only dialysis centre in district X” is as identifying as a name.
Article 3(1)(e): “Processing of personal data: means any operation performed on data such as ... obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of.” In other words publishing is expressly a form of processing — and so is keeping something in the archive.
Article 3(1)(ç): “Data subject: means the natural person whose personal data are processed.” Under Article 2(1) the Law protects only natural persons; information belonging to a company, an association or a public institution itself is not personal data within the scope of the Law. In a story about a company, the company's turnover is not personal data, but the general manager's salary is.
Special categories of data: the riskiest area in a news report (Article 6)
The enumeration in Article 6(1) is a closed list: “Data relating to persons' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, together with biometric and genetic data are special categories of personal data.”
In everyday reporting this list comes straight at us: criminal convictions in court reporting, illness in health reporting, political opinion and trade union membership in protest coverage, religion and sect in coverage of a religious community. All of these are special categories of data.
Article 6(3) (as amended by Law No. 7499) sets the rule out as follows: “The processing of special categories of personal data is prohibited. However, the processing of such data is possible where; a) the data subject has given explicit consent, b) it is expressly provided for in laws, c) it is necessary for the protection of the life or physical integrity of a person who is unable to give consent due to actual impossibility ..., ç) it relates to personal data made public by the data subject and is in accordance with the intention behind making it public, d) it is necessary for the establishment, exercise or protection of a right, e) [health services], f) [employment and social security], g) [activities of foundations, associations and similar bodies directed at their members].”
Article 6(4) adds this: “In the processing of special categories of personal data, it is furthermore obligatory to take the adequate measures determined by the Board.” The content of those measures is determined by decisions of the Board.
General principles: the yardstick for every processing outside the exemption (Article 4)
Article 4(2) lists five principles that must be complied with in every processing operation that does not fall within the exemption:
- a) Being processed lawfully and in accordance with the rules of good faith.
- b) Being accurate and, where necessary, up to date.
- c) Being processed for specified, explicit and legitimate purposes.
- ç) Being relevant, limited and proportionate to the purposes for which they are processed.
- d) Being retained for the period laid down in the relevant legislation or necessary for the purpose for which they are processed.
For a news website, subparagraphs (b) and (ç) carry particular weight. The principle of “being accurate and, where necessary, up to date” is the basis of an infringement claim where a report about someone's detention is not updated after the case ends in acquittal. “Relevant, limited and proportionate” aims directly at personal details having nothing to do with the subject of the report (home address, vehicle registration, the names of family members) appearing in the text.
Processing conditions: if there is no exemption, which subparagraph do you rely on? (Article 5)
Article 5(1) sets the rule: “Personal data may not be processed without the explicit consent of the data subject.” Article 5(2) then lists seven cases in which explicit consent is not required:
- a) It is expressly provided for in laws.
- b) It is necessary for the protection of the life or physical integrity of the person themselves or of another person, where that person is unable to give consent due to actual impossibility or whose consent is not given legal validity.
- c) It is necessary to process personal data of the parties to a contract, provided that the processing is directly related to the conclusion or performance of that contract.
- ç) It is necessary for the data controller to fulfil its legal obligation.
- d) The data have been made public by the data subject themselves.
- e) Data processing is necessary for the establishment, exercise or protection of a right.
- f) Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
In the news context the most debated subparagraphs are (d), data made public, and (f), legitimate interests. The phrase inside subparagraph (f), “provided that it does not harm the fundamental rights and freedoms of the data subject”, stops legitimate interest from being an unlimited justification: you have to carry out a balancing test each time.
How does the Article 28(1)(c) exemption work in a news report, and where is it cut off?
None of the articles above applies while the Article 28(1)(c) exemption holds — because the wording of the paragraph is “The provisions of this Law shall not apply”. But the subparagraph ties the exemption to eight limits: not violating national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, and not constituting an offence. We dealt with the structure of the exemption in detail in journalistic activity and the KVKK exemption.
The practical formula is this: the exemption tests not the news report itself, but the balance between personal rights and freedom of expression. The moment that balance tips in favour of personal rights the exemption falls away; from that point on the principles in Article 4, the conditions in Article 5 or Article 6 and the rights in Article 11 apply retroactively. And under Article 14(3) the right of those whose personal rights are violated to claim compensation under the general provisions is reserved in any event.
The relation to Article 21 of the Press Law: an identity ban independent of the KVKK
Falling within the KVKK exemption does not remove obligations under Press Law No. 5187 (“the Press Law”). Article 21 of the Press Law, under the heading “Non-disclosure of identity”, directly prohibits the disclosure of identity in periodicals in certain cases:
- a) In news items concerning sexual relations between persons who are prohibited from marrying under the Turkish Civil Code, the identity of those persons,
- b) In news items concerning the offences of the former Turkish Penal Code No. 765 listed in the article, the identity of the victims,
- c) The identity of offenders or victims who are under the age of eighteen
The article provides that those who publish in a way that discloses the identity of these persons “or in a manner that leads to their recognition” are to be punished. The phrase “in a manner that leads to their recognition” also covers reports published without giving a name: a child whose face is blurred but whose school, class and neighbourhood are given is perfectly recognisable.
Read the two regimes together: even where the exemption in Article 28(1)(c) of KVKK holds, a publication falling within Article 21 of the Press Law also breaches the eighth limit of the exemption, because it constitutes an offence. In other words a breach of the Press Law simultaneously destroys the KVKK exemption. The safest course is to track this point where the two laws intersect as a single check item inside the legal compliance checklist for internet news sites.
Concrete scenarios
| Scenario | Assessment | Provision to watch |
|---|---|---|
| The name of a victim of a sexual offence, or details that would make them recognisable | May not be published. Because it constitutes an offence, the Art. 28(1)(c) exemption also falls away | Press Law Art. 21(1)(b) · KVKK Art. 28(1)(c) (not constituting an offence) |
| An offender or victim under the age of 18 | Neither the identity nor details leading to recognition may be published | Press Law Art. 21(1)(c) |
| A photograph of an arrested defendant in front of the courthouse | Footage taken in a public place; the balance with personal rights must still be struck. Conviction information is a special category of data | KVKK Art. 6(1) · Art. 28(1)(c) (personal rights) |
| An old detention story remaining in the archive after an acquittal | If the exemption holds the Law does not apply; if it does not, the accuracy principle in Art. 4(2)(b) and Art. 7 come into play | KVKK Art. 4(2)(b) · Art. 7 · Art. 11(1)(e) |
| A public official leaving office because of illness | Health data is a special category. If the person disclosed it themselves, you must stay within the limit of their intention in making it public | KVKK Art. 6(1), Art. 6(3)(ç) |
| Information taken from an accident victim's hospital record | Health data; a leaked record may have been obtained unlawfully | KVKK Art. 6 · Art. 28(1)(c) (not constituting an offence) |
| Inferring political opinion from a photograph of a rally participant | Political opinion is a special category of data; a crowd shot and a framing that singles out an individual are not the same thing | KVKK Art. 6(1) · Art. 4(2)(ç) proportionality |
| An executive's home address in a story about a company | If it is not relevant to the purpose of the report it exceeds proportionality | KVKK Art. 4(2)(ç) |
Pre-publication check flow
PERSONAL DATA IN A NEWS REPORT — PRE-PUBLICATION CHECK
1. IDENTIFICATION
[ ] Does the text contain a name, title, address, plate number, ID number?
[ ] Can the person be identified even without a name?
(role, district, workplace, family link, a one-of-a-kind attribute)
[ ] Does the image/video make the person recognisable?
2. SPECIAL CATEGORY SCAN (KVKK Art. 6(1))
[ ] race / ethnic origin [ ] health
[ ] political opinion [ ] sexual life
[ ] philosophical belief [ ] criminal conviction
[ ] religion / sect / belief [ ] security measure
[ ] appearance and dress [ ] biometric data
[ ] association/foundation/union [ ] genetic data
If even one is ticked -> write down the legal ground under Art. 6(3)
3. ABSOLUTE PROHIBITION CHECK (Press Law Art. 21)
[ ] Victim of a sexual offence? -> DO NOT give identity
[ ] Offender or victim under 18? -> DO NOT give identity
[ ] Report on sexual relations between
persons prohibited from marrying? -> DO NOT give identity
NOTE: Details leading to recognition are within the ban too.
4. PROPORTIONALITY (KVKK Art. 4(2)(ç))
For each item of personal data: if this detail were removed,
would the report be incomplete? NO -> remove it.
5. KEEPING IT UP TO DATE (KVKK Art. 4(2)(b))
[ ] The outcome of the case added to a follow-up list
[ ] A note to be added to the report on acquittal / no prosecution
6. RECORD
Keep the reasoning for the publication decision as a file note:
date / decision-maker / legal ground / details removedThe updating obligation in step five prevents most future takedown requests from arising at all. If a request comes anyway, you can find the procedure to follow in the articles on the right to be forgotten and on content removal requests. The reader data you collect on the site, on the other hand, is subject to an entirely separate regime; for that you need to prepare a privacy notice.