The complaint letter submitted to the Authority asserts briefly that; the data subject applied for a job through the website established by the data controller where the data subject shared his/her personal data with the data controller. Following the application, the data subject was interviewed and the result was negative, after which he/she deleted the resume on the website and made a request to the data controller through phone and email for the erasure of his/her data. However, the response e-mail by the data controller expressed that personal data of the data subject would be stored for possible job applications to the data controller. Due to the fact that the data controller did not erase the personal data, although the data subject stated that he/she had no business demand, interest or relationship with the data controller, the data subject lodged a complaint with the Authority and requested necessary action be taken within the scope of the Personal Data Protection Law No 6698 (the Law).

Within the framework of the examination initiated on the subject, the data controller was asked for defence against the claims in question. The data controller, in its response letter, states the following, in summary: 

• •The data subject applied for a job through the website in question, and the personal data relating to him/her was processed in accordance with Article 10 of the Law after the obligation to inform was fulfilled,
• Personal data in question was processed;
  • in order to examine the job application and to obtain the necessary information for the establishment of the employment contract, to evaluate the qualification for the job and to carry out other tests within the scope of Article 5(2)(c) of the Law regulating that “processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract”; 
  • in order to examine if the data subject is suitable for the position applied for, to confirm the accuracy of the information conveyed, and to conduct the necessary interviews within the scope of Article 5(2)(e) regulating that “data processing is necessary for the establishment, exercise or protection of any right”;
  • in order to evaluate the compliance of the data subject with the company principles and to match the information submitted in other applications within the scope of Article 5(2)(f) of the Law regulating that “processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.”
• After the job application of the data subject is not accepted following the evaluations made by the data controller; the personal data processed for the purposes listed above were erased upon the request of the data subject because the purpose of processing was no longer exist in accordance with Article 7 of the Law, but only the name, surname and identity number information and the general reason for the evaluation of the application of the data controller are preserved. The purpose of preserving these data is that the previous application can also be taken into account in the evaluation of the job applications to be made by the data subjects after the rejected applications, aiming to prevent false data in the subsequent applications and the data subject was informed of the purpose for this storage in accordance with Article 11 of the Law.
• In the second request made by the data subject, it was understood that the name-surname and identity information were also requested to be erased, and it was decided to erase those data considering that the power of disposition on the personal data of the data subject is priority, and the data subject was informed that his/her personal data would be erased in the first periodical disposal period. 

As a result of the assessment made on the subject, the Board evaluates that:

• Article 4(1) of the Law rules that “Personal data shall only be processed in compliance with procedures and principles laid down in this Law or other laws” and Article 4(2) lists the principles to be complied within the processing of personal data as; lawfulness and fairness, being accurate and kept up to date where necessary, being processed for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purposes for which they are processed, being stored for the period laid down by relevant legislation or the period required for the purpose for which the personal data are processed.
• Article 5(1) of the Law stipulates that personal data shall not be processed without explicit consent of the data subject, and subparagraph (2) of the same Article rules that “Personal data may be processed without seeking the explicit consent of the data subject only in cases where one of the following conditions is met:
  • It is expressly provided for by the laws.
  • It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.
  • Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
  • It is necessary for compliance with a legal obligation to which the data controller is subject.
  • Personal data have been made public by the data subject himself/herself.
  • Data processing is necessary for the establishment, exercise or protection of any right.
  • Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
• Article 7of the Law sets forth that (1) “Despite being processed in compliance with the provisions of this Law and other relevant laws, personal data shall be erased, destructed or anonymized by the data controller, ex officio or on the request of the data subject, in the event that the reasons for the processing no longer exist.”, (2) “The provisions of other laws relating to the erasure, destruction or anonymization of personal data are reserved”, and (3) “Procedures and principles for the erasure, destruction or anonymization of personal data shall be laid down through by-law.” and within this scope, the “By-Law on the Erasure, Destruction or Anonymization of Personal Data” entered into force.
• Article 8(1) of the By-Law on the Erasure, Destruction or Anonymization of Personal Data defines the erasure as “the process of rendering personal data inaccessible and non-reusable for the users concerned, by no means”, and the second paragraph rules that “The data controller is obliged to take necessary technical and organizational measures required for ensuring erased data to be inaccessible and non-reusable for its users concerned.”
• The By-Law arranges the erasure of personal data in two ways; firstly, the personal data is erased ex officio by the data controller, and secondly, the personal data is erased upon the request of the data subject. 
• Article 11 of the By-Law regulating the periods for ex officio erasure, destruction and anonymization of personal data rules that (1) The data controller, who has issued data storage and disposal policy, shall erase, destruct or anonymize the personal data in the first periodic disposal process following the date when obligation of erasure, destruction or anonymization of personal data arises. (2) Time interval for periodic disposal shall be defined in personal data storage and disposal policy by the data controller. This time interval cannot exceed six months in any case. (3) Data controllers who are not obliged to issue personal data storage and disposal policy, shall erase, destruct or anonymize personal data within three months following the date for obligation of erasure, destruction or anonymization of personal data arises.
• Furthermore, Article 12 of the By-Law regulating the period for erasure and destruction of personal data upon request of data subject rules that (1) (Amendment- OG-28/4/2019-30758) When the data subject requests erasure or destruction of his/her personal data from the data controller, pursuant to Article 11 and 13 of the Law;

a) In the event that all of the conditions for the processing no longer exist; the data controller shall erase, destruct or anonymize the mentioned personal data which are subject to the request. The data controller shall act on the request of the data subject at the latest within thirty days and inform the data subject.
b) In the event that all of the conditions for the processing no longer exist and the personal data which are subject to the request have been transferred to any third party; the data controller shall notify the third party of such request and ensure the performance of necessary operations by the third party within the scope of this By-Law.
c) In the event that all of the conditions for the processing have not disappeared completely, the request may be rejected by the data controller in accordance with the Article 13(3) of the Law together with its justified grounds and such rejection shall be communicated to the data subject in writing or by electronic means at the latest within thirty days.

• In the response letter received from the data controller regarding the claim that data subject’s request for erasure is not met, the controller explains that; personal data relating to the data subject was processed in accordance with subparagraphs (c), (e), (f) of Article 5 of the Law by fulfilling obligation to inform, the data in question was erased after the first request of the data subject; however, name-surname, ID details and assessment scores of the interview were kept being stored, and the reason is that previous application can also be taken into account in the evaluation of the job applications to be made by the data subjects after the rejected applications, and the data subject was informed that those data would be stored under the “legitimate interest” of the data controller as laid down in Article 5(2)(f) of the Law, but the data subject refused it and made a request again, stating that he/she has no career plan and possible job application with the bank and requested that all personal data stored in the bank be erased. As a response to this request, the data controller declared its intention to data subject and the Authority to erase those data, by prioritizing the data subject’s power of disposition on his/her personal data, on its first periodic disposal period as stipulated in Article 11 of the By-Law on the Erasure, Destruction or Anonymization of Personal Data,
• However, the attached document to data subject’s complaint submitted to the Authority shows that, there is ambiguity in the data controller’s statement of “the identity information, name, surname information of the data subject will be kept within the framework of the legitimate interest of the bank for the possible job applications", because processing the data for the legitimate purposes within the scope of Article 5(2)(f) of the Law does not give unlimited space to the data controller,
• In this context, defence of the data controller based on legitimate interest should be evaluated, in terms of storing the personal data of the data subjects for the possible future applications,
• Within this framework, the statement of the data controller in response to data subject’s request that it will erase the data in the first periodical destruction is an indication that the processing of personal data is not compulsory for the data controller to achieve the interest mentioned, and the legitimate interest by the processing data is not competitive with the fundamental rights and freedoms of the individuals. Moreover, the legitimate interest of the data controller for the storage of the data is not clear and unambiguous. It is also considered that the legitimate interest of the data controller does not override the fundamental rights and freedoms of the data subject in the processing of the personal data, because the expected benefit of the data controller from the processing activity can be obtained in another way and method without the processing of personal data and that the data processing activity in question does not provide an institutional benefit that will affect a large number of people.

On the basis of the foregoing evaluations, The Board with its Decision numbered 2021/670 and dated 6 July 2021, decides:

• to impose an administrative fine on the data controller pursuant to Article 18(1)(b) of the Law for the failure to take technical and organizational measures to ensure appropriate level of security to prevent the unlawful processing of personal data as laid down in Article 12(1) of the Law, considering that personal data has not been deleted within 30 days pursuant to Article 12 of the By-Law on the Erasure, Destruction or Anonymization of Personal Data, because the data controller first partially accepted data subject’s request for erasure and continued processing the name, surname and identity information was continued, and then, after the second request made by the data subject, the controller responded that the data in question will be destroyed in the first periodical disposal period. Also taking into account that the personal data of the data subject continued to be processed without relying on any processing conditions set forth in Article 5 of the Law.

And the Board further decides that:

• Data controller shall destruct the personal data of the data subject and inform the Board of the result,
• In the event that there are other persons whose job application has been unsuccessful, the data controller shall also destroy their personal data in accordance with the provisions of Article 7 of the Law and inform the Board of the result.