In summary, in the complaint petition submitted to the Authority, it was requested that necessary action be taken about the data controller by expressing that after a shopping with a textile company (data controller), enforcement proceedings are initiated against the spare parts company (Company) in which the name of the data subject is mentioned, in this process, in a group open to everyone on Facebook by a person, a public comment was made that “The company did not pay for the masks it bought, it was a fraud, accordingly, an enforcement proceeding has been initiated against the Company and that the documents regarding the enforcement will be shared with this group”, as a result of the research done on the internet on behalf of the person sharing the information, it has been determined that the data controller company is recognized as the addressee, although the data subject with the aforementioned person has no commercial relationship, the personal data in the execution file are violated by sharing the personal data with third parties, it is not clear how information about the execution file was obtained by the person who is not mentioned in the trade registry record of the data controller company, but who introduces himself as a company official, in this regard, in accordance with the rights under Article 11 of the Law on the Protection of Personal Data No. 6698 (Law), an application has been made to the data controller, but no response has been received in due time.

Within the framework of the examination initiated regarding the issues in the complaint petition, the data controller was asked to defend it, in summary, in the reply article it has been expressed that;

• It has been decided that the Company, in which the name of the data subject is mentioned, is a party to the complaint submitted to the Public Prosecutor's Office regarding the social media posts subject to the complaint, and it has been decided that there is no need to prosecute on the grounds that the party subject to the complaint is not a person, but a legal entity, and that the legal elements of the crime do not exist,
• The person who made the posts subject to the complaint submitted to the prosecutor's office was a part-time employee of the company whose name the data subject was mentioned at that time, then left the company and then started to work for the data controller,
• The complainant party has received a large amount of goods from the data controller company, in this process, the company is the customer of the person who shares the shares, this person is the person who markets, offers and takes the order of the related products, in other words, the Company is in the portfolio of this person,
• The Company did not pay for the purchase of goods, did not respond to e-mails and telephone calls, could not contact the Company in any way, and an enforcement proceeding was initiated against the Company,
• There are no social media accounts opened on behalf of the data controller and no sharing is made under the title of the data controller,
• Since the aforementioned person suffered a lot from this marketing, he briefly explained the situation with the Company in a Facebook group of which he is a member, in order to prevent other companies from being harmed by this company, as a proof, he shared the front cover image of the case file in an unreadable way, but this post was deleted before it was published and third parties did not see the said post, and after the event, the aforementioned person was removed from the group and blocked.

As a result of the examination carried out on the subject, with the decision of the Personal Data Protection Board dated 10/02/2022 and numbered 2022/103; based on the following evaluations;

• In the Article 3 of the Law titled “Definitions”, “personal data” means any information relating to an identified or identifiable natural person; “data subject” means the natural person, whose personal data are processed; “data controller” means the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system; “processing of personal data” means any operation which is performed on personal data, wholly or partially by automated means or non-automated means which provided  that form part of a data filing system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof,
• In the opinion of the Article 29 Data Protection Working Group, dated 04.06.2007 and numbered 4/2007, which was prepared based on the Data Protection Directive No. 95/46/AT and the “concept of personal data” was discussed; the fact that the information about legal persons is “related” to natural persons should be considered in the concrete case, it is stated that in cases where the title of legal persons is derived from the names of real persons, it is stated that whether there is personal data or not should be evaluated according to certain criteria (content, purpose and result criteria), with the opinion of the Article 29 Data Protection Working Group, for example, this may be the case in the use of a company email by a particular employee or in information expressing the behaviour of the owner of a small business, when evaluated according to the “content”, “purpose” or “result” criteria, it is stated that the information about the business or legal person can be considered as personal data if it is possible to be related to a natural person, the criteria in question do not need to be cumulative, and the criteria can be considered as alternatives to each other, according to the said opinion; it is also considered that the same information will be associated with different people in terms of different elements, for example, if an information is about person A, it can be said that it is related to person A in terms of content, with person B in terms of purpose if it is used for the purpose of treating person B in a certain way, with person C in terms of “consequence” if it has or is likely to have an effect on the rights and interests of person C,
• •    The relevant company bears the name and surname of the authorized person, and it should be considered whether the company title is personal data in accordance with subparagraph (d) of paragraph (1) of Article 3 of the Law, in particular, even though the name and surname of the data subject is included in the title of the merchant in the execution proceedings, when it is taken into account that the legal entity is targeted in the shares and comments made, the company’s title or debt information, address, tax identification number information does not meet the definition of personal data in the Law, with the belief that it does not have an effect on the rights and interests of the natural person or is not used for the purpose of treating the natural person in a certain way,
• Pursuant to paragraph (1) of Article 2 of the Law, the provisions of the Law will be applied to natural persons whose personal data are processed, and to natural and legal persons who process this data fully or partially automatically or by non-automatic means provided that they are part of any data recording system,
• Specific to the concrete case, the subject is not within the scope of the Article 2 (1) of the Law due to the fact that personal data is not processed in sharing the document in the social media platform, which is obtained by the employee of the data controller by photographing the enforcement proceedings request document, and sharing comments containing some information about the Company on the social media platform,

Although the name and surname of the data subject is mentioned in the name of the Company, which is the subject of the complaint, since it is understood that the legal entity is targeted in the shares made on the social media, it has been decided that there is no action to be taken since the data in question is considered as the data of the legal entity, not the real person.