The Board of the Protection of Personal Data has published a decision titled “The Criteria to be Considered in the Evaluation Regarding the Extraction of the Results of Searches with Name and Surname of People on Search Engines from the Index” which is dated 23/06/2020 and numbered 2020/481 and which basically concerns the right to be forgotten. This decision seems to be one of the important steps within the scope of compliance with the GDPR and the Law on the Protection of Personal Data.
Briefly, in this decision, search engine operators have been accepted as data controllers in line with the regulation implemented in the European Union member countries and in accordance with the regulations in the Law on the Protection of Personal Data legislation, these have been qualified as data controllers and the way to apply to these people has been made possible. In other words, it stated that the activities carried out by search engines, also the determination of the purposes and means of processing data collected by search engines from the internet are essentially data processing activities and what these data processing activities are, clearly counted in the relevant decision. Although we say that this decision is within the scope of “the right to be forgotten”, this concept is one of the new concepts in terms of our law. Although the right to be forgotten is not defined as a right in the legislation, it has only been included among the measures to establish the right in various codes, its name is mentioned several times in the decisions of the Constitutional Court and the Supreme Court.
In the relevant decision, the right to be forgotten has been evaluated within the scope of the Paragraph 3 of the Article 20 of our Constitution, Articles 4, 7 and 11 of the Law on the Protection of Personal Data numbered 6698 and the Article 8 of the Regulation on Deletion, Elimination or Anonymization of Personal Data and the Board paved the way for the protection of the right to be forgotten by preventing the conceptual deficiencies in our legislation mentioned above. With to this decision, the right to be forgotten has been recognized and the personal data on the internet is passed to be under the control of the personal data owner instead of being processed for the commercial purposes of the search engine operators. At this point, we can say that the priority is given to the protection of personal data in case of the conflict between the right to protection of private life and the right to freedom of expression in the digital environment, by considering that all of them are guaranteed by the Constitution.
In addition, we can say that this regulation is in accordance with the principle of protecting the blind side that prevails in our law. In the decision of the Court of Justice of the European Union between Google Spain and Google Inc. and Agencia Española de Protección de Datos (AEPD) and Mario Costeja González dated 13.05.2014 and numbered C-131/12, it is stated that search engines were unable to link this information without search engines and that they could create a list and access structured information about that person as a result of their searches on the Internet for everyone using the Internet, and it is also stated that the information obtained could potentially relate to many different aspects of a person’s private life and that a personal profile could be created for this person.
The greatest importance of the decision in terms of Turkish Law is that it may be a precedent. Yet, with this decision, the Board reveals their intention to effectively exercise the right to be forgotten. At the same time, it is made possible for individuals to apply to the search engine operators first and then to the Board in accordance with the Law on the Protection of Personal Data legislation without filing actions. It is expected to reduce the workload of the Courts with such practice.