In decision of the Constitutional Court dated March 02, 2022 and numbered 2019/20473, which was published in the Official Gazette dated March 18, 2022 and numbered 31782 rendered as per the “H.Ö Application” (“Decision”), it was decided that the right to demand the protection of personal data within the scope of the right to respect for private life has been violated due to the lack of an effective criminal investigation against the complaint regarding the unlawful obtainment of personal data.


I. SUMMARY OF FACTS

The applicant H.Ö. (“Applicant”), filed a complaint against her spouse, with the allegations that he has committed professional misconduct, violation of privacy, unlawful obtainment of personal data and sharing of data claiming that he has obtained her pre-marital hospital records, the number of the outpatient clinic where she received treatment, prescriptions and relevant treatment date and treatment information, in violation of her right to privacy and the protection of personal data, and that he having worked as a doctor in the relevant province has accessed the information that must be kept confidential by the hospital by using his professional privileges without the request of a competent authority, and presented it as evidence to the divorce case pending between them.

Afyonkarahisar Chief Public Prosecutor’s Office (“Chief Prosecutor”), which was conducting the criminal investigation, requested the applicant’s treatment information from the hospital via a warrant. In addition, a detailed report has been requested which determines the names and duties of the public officials who accessed and/or printed out the relevant information together with the date and time interval of the access, the information regarding the devices that were used while entering the system.

In his statement to the Chief Prosecutor, the Applicant’s spouse stated that the Applicant made statements against him in the divorce and criminal cases, and she even claimed that her migraine headaches increased due to her experiences in marriage. Upon this, he went to the hospital to learn about his wife’s illness before marriage, and did research on the hospital computer, as a result of the research, saw that she had some diseases, but he did not obtain any documents, did not intend to violate the personal rights of the Applicant, and acted with the aim of protecting himself during the trial, and did not violate the privacy of patient rights.

The Applicant has requested that the investigation be expanded by filing an additional complaint petition. In her petition, the Applicant emphasized that her spouse has in fact openly admitted that he had committed the alleged crime, since he stated that he went to the hospital and searched the hospital records from the hospital computers, and stating that there is a password on the hospital computers, requested the determination of the other suspects who assisted and participated in the commission of the crime by investigating the computer from which the Applicant’s spouse had accessed the hospital records and by identifying those using the relevant computer.

The Chief Prosecutor stated that the spouse has the right to access personal and health information due to being a first-degree relative of the Applicant, therefore decided not to prosecute on the grounds that the action of the suspect cannot be considered as a violation of privacy and private life, and at the same time, presenting the claims and evidences within the scope of the ongoing case between the parties remains within the scope of immunity of claim and defense, and the evaluation of evidence belongs to the authority conducting the trial.

In her objection to the non-prosecution decision, by emphasizing that it was decided upon incomplete examination, the Applicant stated that the confidentiality of hospital records is subject to strict rules within the scope of the protection of personal data, the legislation allows access to a limited number of persons and there is no regulation in the legislation stating that spouses or first-degree relatives can access these records, and that it was not regulated as a reason for compliance with the law.

The appeal against the decision was rejected by the Afyonkarahisar 1st Criminal Magistrate of Peace.

II. RELEVANT LEGISLATION

The Constitutional Court determined that the application is subject to Article 136 of the Turkish Penal Code No. 5237 (unlawful giving or acquisition of data) and Article 137 (qualified cases); Article 23 of the Patient Rights Regulation (“Regulation”) (confidentiality of information); Article 160 of the Criminal Procedure Law No. 5271 (the duty of the Public Prosecutor having learnt that a crime has been committed), and finally, Article 1 (purpose of the Law), Article 6 (conditions for the processing of sensitive personal data), Article 8 (transfer of personal data), Article 12 (obligations regarding data security) of the Personal Data Protection Law No. 6698 (“PDPL”).

III. ASSESSMENT OF THE CONSTITUTIONAL COURT

According to the Decision, it is clear that the information regarding the treatments received by the Applicant, her state of health, and the diseases she had suffered are in the nature of personal data, and the illegal obtainment and disclosure of such information is regulated as a crime under the relevant legislation. In addition, it has been emphasized that, pursuant to the PDPL, health information requires the explicit consent of the person, which is considered to be within the scope of sensitive personal data, that it is prohibited to be processed without the explicit consent of the person, except for the exceptions specified in the article, and that obligations are envisaged for the data controller to take measures to prevent unlawful access to the personal data entrusted to them. It was stated that pursuant to the Regulation, the disclosure and processing of private hospital records are subject to strict conditions and an effective criminal investigation should be carried out, by taking into account the relevant legislation regarding the Applicant’s complaints.

Considering the trial process, it is understood that the Applicant did not disclose to her spouse the information about her treatment before marriage and did not have an explicit consent on the procurement of it to third parties, including her spouse, and despite these facts the Chief Prosecutor has claimed that “the spouse has the right to access personal and health information since he is a first-degree relative of the Applicant” , such claim has no legal basis and this justification (i) is based on a strong presupposition, (ii) is handled with a “rule without an exception” approach, (iii) leaves the person unprotected in terms of the right to request the protection of personal data and patient rights, and (iv) does not deter similar interventions.

The Constitutional Court concluded that an effective and diligent investigation was not carried out in a way that would secure the constitutional rights, since the allegations regarding the clarification of the incident were not investigated by the Chief Prosecutor, the investigation was not deepened, and the conclusion was reached with reasons that did not have a legal basis; and in the non-prosecution decision and in the decisions rendered as a result of the objection against this decision, the judicial authorities did not explain their grounds in a way that protects personal data and patient rights.

IV. CONCLUSION

The Constitutional Court concluded that the right to demand the protection of personal data within the scope of the respect for private life, regulated in Article 20 of the Constitution, was violated due to the fact that the investigation was not conducted effectively and diligently and the conditions required under the obligations of the public authorities were not fulfilled in the present case, and decided to send the file to the relevant Chief Prosecutor for further investigation in order to eliminate the consequences of the violation.

More from Güner Law Office