In summary, in the complaint of the data subject about the liaison office in Türkiye of the data controller residing abroad, it has been specified that;

• When the data subject is accepted to work, the liaison office of the data controller asks for criminal record, health report, lung film report, blood group certificate, photocopy of driver’s license, photocopy of marriage certificate and identity card of family members, and these documents are delivered by the data subject,
• The liaison office has not obtained explicit consent from the data subject for the processing of the aforementioned special categories of personal data,
• Requesting identity card information of family members contradicts the general principles in Article 4 of the Law,
• The data controller does not fulfil the issues specified in the Decision of the Personal Data Protection Board (Board) dated 31/01/2018 and numbered 2018/10 in the processing of special categories of personal data,
• Due to the fact that the data controller is a resident abroad, the personal data of the data subject may also be transferred abroad,
• The data controller does not respond to the application of the data subject within the 30-day legal period

and it has been requested to take necessary actions in accordance with the provisions of the Law on Protection of Personal Data No. 6698 (Law).

Within the framework of the examination initiated on the subject, the data controller was asked to defend it with a letter written to the liaison office in Türkiye, in summary in the reply letter, it has been specified that;

• The complainant is the liaison office of the data controller originating abroad, and does not have a separate legal entity and commercial activity in accordance with the legal establishment principles,
• The work of the data subject within the body of the data controller is determined directly in accordance with the provisions of the foreign-based legal legislation, and accordingly, the workplace registry file is created in accordance with the provisions of the current legislation abroad,
• Since the data subject is the employee of the data controller residing abroad, the personal data subject to the complaint of the data subject is obtained from the data subject within the scope of the personal file of the workplace, and in this sense, it is not possible to mention a situation such as transferring the personal data abroad without permission,
• The personal data subject to the complaint is kept as a “personnel file” under the responsibility of the liaison office complained during the employment contract, in accordance with the legitimate purpose determined by the relevant legal legislation and laws, and following the termination of the employment contract, a copy of the case file filed by the data subject before the Labour Court is presented, and then, although there is no legal obligation, the personal data in question is destructed in the records of the liaison office and foreign units.

As a result of the examination carried out on the subject, with the Decision of the Board dated 24/02/2022 and numbered 2022/172, based on the following evaluations;

• The purpose of the Law is to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data, and to regulate the obligations of natural and legal persons who process personal data and the procedures and principles to be followed, in the Article 3 of the Law titled “Definitions” “data subject” means the natural person, whose personal data are processed, “data controller” means the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system,
• In paragraph (1) of Article 4 of the Law, which regulates the “General Principles” regarding the processing of personal data, personal data shall only be processed in compliance with procedures and principles laid down in this Law or other laws, in the Article (2) the following principles shall be complied within the processing of personal data:
  a) Lawfulness and fairness
  b) Being accurate and kept up to date where necessary.
  c) Being processed for specified, explicit and legitimate purposes.
  ç) Being relevant, limited and proportionate to the purposes for which they are processed.
  d) Being stored for the period laid down by relevant legislation or the period required for the purpose for which the personal data are processed.
• In paragraph (1) of Article 5 of the Law titled “Conditions for processing personal data” Personal data shall not be processed without explicit consent of the data subject, in the Article (2) Personal data may be processed without seeking the explicit consent of the data subject only in cases where one of the following conditions is met: it is expressly provided for by the laws, it is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid, processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, it is necessary for compliance with a legal obligation to which the data controller is subject, personal data have been made public by the data subject himself/herself, data processing is necessary for the establishment, exercise or protection of any right, processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
• In paragraph (1) of article 12 of the Law regulating “Obligations concerning data security” the data controller is obliged to take all necessary technical and organizational measures to provide an appropriate level of security for the purposes of preventing unlawful processing of personal data, preventing unlawful access to personal data, ensuring protection of personal data.
• On the other hand, according to the Article 2 of the Labor Law No. 4857 (“Law No. 4857”), titled “Definitions”, “The employee is a real person working under an employment contract; the employer is a real or corporate person or a noncorporate institution or organization employing employees; and the relationship established between the employee and employer shall be referred to as the employment relationship. The unit wherein the employees and material and immaterial elements are organized with a view to ensure the production of goods and services by the employer is called the establishment… The employer’s representative is the person acting on behalf of the employer and charged with the direction of work, the establishment and enterprise. The employer is directly liable towards the employees for the conduct and responsibilities of his representative acting in this capacity.”
• In the Article 2 of the Law No. 4875 titled “Definitions”, it has been specified that “Foreign investor: 1) Real persons who possess foreign nationality and Turkish nationals resident abroad, and 2) Foreign legal entities established under the laws of foreign countries and international institutions, who make foreign direct investment in Türkiye.”
• However, in Article 6 of the Regulation for Implementing of the Foreign Direct Investments Law, titled “Establishment of Liaison Offices”, “The Undersecretariat is authorized to grant permits and extend such permits to companies established in accordance with the laws of foreign countries to open liaison offices in Türkiye, provided that they do not carry out commercial activities in Türkiye...”
• In the concrete case, it was seen that the party complained of was the liaison office of the data controller, a legal entity residing abroad, and according to the information obtained from the website of the data controller, the data controller was purchased by a software company based in another country, in this case, the data controller is a liaison office which does not carry out commercial activities in Türkiye, has no legal personality and only engaged in “Communication and Information Transfer” activities of the Türkiye Liaison Office and is subject to foreign capital legislation,
• On the other hand, liaison offices are included in the “establishment” status according to the Law No. 4857, according to the Law No. 4875, “foreign investor” means real persons who possess foreign nationality and Turkish nationals resident abroad, and foreign legal entities established under the laws of foreign countries and international institutions, who make foreign direct investment in Türkiye.”
• It is understood that the investors specified in the Law No. 4875 will gain the title of employer in terms of labor law, and thus, the employer who employs the liaison office employees and therefore the data subject; the data controller will be the data controller himself, not the liaison office,
• For these reasons, it has been concluded that in the concrete case, the title of “data controller” can be attributed to the data controller residing abroad and having a legal personality, not to the Turkish Liaison Office of the data controller residing abroad,
• In the notification sent by the data subject, the company manager of the data controller is included as “authorized”, it is seen that the company manager is authorized on behalf of the data controller with a power of attorney approved and issued by the authorized notary of the place of residence abroad, in this case, the notification made by the data subject to the data controller through the Liaison Office representative and the employer’s representative is legally valid, the data controller should have responded to this, but the data controller has not responded to the application of the data subject within the legal period, in this way, it has been determined that the data controller has acted in violation of the provisions of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller (“Communiqué”) regarding responding to the applications of the data subjects,
• Considering that the employer title is above the data controller based abroad, it will be necessary to conclude employment relationship agreements with the employees, not with the liaison office, but with the data controller, in this case, as per the contract concluded within the scope of this business relationship, there will be no illegality in the transfer of the personal data of the data subject by the liaison office to the data controller residing abroad, since the title of “data controller” is already abroad, since the party of the contract is directly a data controller based abroad,
• It is not possible for the data subject not to think that the personal data in the form of information and documents obtained from him in accordance with the foreign legislation to which the data controller is subject will be processed abroad, while making a business contract to work within the body of the data controller of foreign origin, in the event that there is no legal way other than obtaining explicit consent from the data subject in order to fulfill the requirements of a contract, requesting explicit consent from the parties while establishing this contract will not injure the legal elements of explicit consent, since the data subject is aware of the fate of his personal data when this contract is concluded,
• Although it is claimed by the data controller that the personal data of the data subject is processed for the purpose of creating a personal file in accordance with the law of the foreign country to which it is subject, no information or document supporting the explanations on this subject is submitted, and the data controller has not disclosed to the Board which law provided these documents in accordance with which provision,
• On the other hand, although it is claimed by the data controller that all personal data of the data subject was destructed at the company headquarters and liaison office, a document supporting this was not submitted to the Authority, in accordance with the provision “All transactions regarding the erasure, destruction and anonymization of personal data are recorded and these records are kept for at least three years, excluding other legal obligations.” specified in the paragraph (3) of the Article 7 of the Regulation on the Erasure, Destruction or Anonymization of Personal Data, which regulates the “Principles”, data controllers are obliged to document the erasure transactions they have made and to submit the said document to the official authorities if requested,
• In the article on the request for information and documents sent to the data controller, the answers to all the allegations in the petition of the data subject and the records and documents supporting these answers are requested, but the data controller cannot submit these documents to the Board.

Since it has been understood that;

• In the concrete case, the title of “data controller” belongs to the company based abroad, not the liaison office,
• Since the director of the liaison office is also the representative of the employer of the data controller, the notification made by the data subject to the liaison office is legally valid,
• No response was given to the application made by the data subject to the data controller within the legal time limit, in violation of the provisions of the Law and the Communiqué,
• In the concrete event that constitutes the subject of the complaint, it is not illegal to transfer data abroad, the personal data of the data subject is obtained through the contract concluded by the data controller residing abroad, within the scope of the business relationship, in accordance with the law of the country of residence, but sufficient explanations were not made to the data subject and the Board regarding the provisions of this legislation. 
• Since it is understood that the personal data of the data subject must be processed abroad for the performance of the said employment contract and the only way to do this is to obtain the explicit consent of the data subject, the explicit consent obtained from the data subject is lawful,
• A supporting document stating that the personal data of the data subject has been destructed both at the company headquarters and at the liaison office has not been submitted to the Authority.  

It has been decided to instruct the data controller on;

• Paying the utmost attention and care to the applications of the data subjects,
• Informing the Board of the result of the transaction, together with the document confirming this issue, by transmitting the document showing that the personal data of the data subject was destructed at the company headquarters and liaison office.