The Personal Data Protection Board (“Board”) evaluated a complaint regarding a company sharing the information about a data subject's current employer received in a job interview with the data subject's current employer in its decision dated 04.08.2022 and numbered 2022/798.
In the complaint subject to the decision, it was claimed that the personal data of the data subject is processed and transferred unlawfully since the statements made by the data subject during the job interview with the data controller company are shared with the data subject’s current company.
The Board provided the following explanations regarding the complaint;
The data subject both filed a complaint with the Board and filed a criminal complaint against the data controller company. The data controller has stated in its defense that the application of the data subject was not answered since the result of the investigation initiated against the data controller's manager was awaited. However, the investigation in question is related to the employee of the company, and the data controller’s obligation to respond within the scope of the Personal Data Protection Law No. 6698 (“DPL”) and the Communiqué on Application Procedures and Principles to the Data Controller (“Communiqué”) is not affected by this investigation. Therefore, the data controller violated Article 6 of the Communiqué.
It is clear that the party which the data subject lodged a complaint against processes the personal data in the capacity of the data controller, and this should be evaluated within the framework of the DPL. In this context, the decision of the Office of the Chief Public Prosecutor not to prosecute was given as a result of the evaluation made within the framework of the Turkish Penal Code and has no effect within the scope of the examination carried out by the Board.
In this regard, the Board adopted the following decisions;
Since the applications of the data subject made in accordance with the Communiqué are not answered within the legal period, it has been decided to warn the data controller about paying maximum attention and care to comply with the provisions of the Communiqué.
The transfer of the information by the data controller that the data subject had a job interview with their company and that the data subject made many statements about his/her current company was not carried out in accordance with Article 8 of the DPL. Therefore, an administrative fine of TRY 100.000 (approx. 4.420 EUR) has been imposed on the data controller considering that this situation is in violation of the obligation of the data controller to take the necessary technical and administrative measures in order to prevent the unlawful processing of personal data in Article 12 of the DPL.
Authors: Burak Özdağıstanli, Bensu Özdemir, Ebru Gümüş
Comments