News and developments
THE RIGHT OF ACCESS TO PERSONAL DATA BY INDIVIDUALS UNDER REGULATIONS OF THE EUROPEAN UNION, TURKEY, & SWITZERLAND
In this regard, EU legislation (Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals concerning the processing of personal data and on the free movement of such data [Dir 95/46/EC] and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with a view to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) [Reg 2016/679]) deserves a special mention as it exerts great influence not only on Member States but also on personal data protection laws of non-EU (or EEA) Members such as Turkey or Switzerland. However, given the absence of direct applicability and transposition requirements of EU law in Turkey and Switzerland, their national legislations differ in certain aspects from EU law and show notable discrepancies between themselves.
Considering the ongoing concerns about data protection and recent legislative developments in this field, the following will target to examine one of the essential pillars of the personal data protection architecture, namely, the right of individuals to access their personal data and its limitations.
Access to personal data in EU Regulations
Dir 95/46/EC
Under the EU’s personal data protection legislation, the right of access is fundamental; but it is not absolute. This was already enshrined in Dir 95/46/EC stating that any person must be able to exercise the right of access to personal data, which is being processed, and that, this right must not adversely affect third-party rights such as trade secrets or intellectual property (Recital 41). It was further recognized that Member States could – in the interest of the data subject or to protect the rights and freedoms of others – restrict the rights of access to information (Recitals 41-43). Nevertheless, such considerations should not result in the data subject being refused all information (Recital 41). Accordingly, the Directive detailed the right of access and possible exceptions and restrictions to pose the frame in which Member States could legislate. Precisely, Article 12 of Dir 95/46/EC held that the right to access personal data is guaranteed for every data subject without constraint at reasonable intervals and without excessive delay or expense. This included the right to obtain information from the controller information as to whether data relating to the data subject was being processed and the purpose of such processing, communication in intelligible form of data undergoing processing, as well as the details on the logic involved in case of automatic data processing (Article 12(a)). Article 13 of Dir 95/46/EC set out an exhaustive list of exemptions and restrictions through which Member States could limit the scope of, inter alia, the right of access through legislative measures. Specifically, Member States could apply such limitations in their national legislation to safeguard:- national security,
- defense,
- public security,
- the prevention, investigation, detection, and prosecution of criminal offences, or of breaches of ethics for regulated professions,
- an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters,
- a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c) (d) and (e),
- the protection of the data subject or of the rights and freedoms of others.
Reg 2016/679
At the EU level, the contours of the right of access were sharpened in 2016 with the enactment of Reg 2016/679, which – unlike its predecessor – is directly applicable in Member States (Art. 288 Treaty on the Functioning of the European Union). To counteract the fragmentation within Member States and address the differences in the level of protection concerning personal data, Reg 2016/679 seeks to forge a harmonized regime that is consistent and homogeneous in all Member States. However, this does not prevent Member States to introduce further national legislation to specify the rules introduced at the European level (Recital 10). In respect of the right of access, Reg 2016/679 restates the underlying considerations already included in Dir 95/46/EC and holds that the exercise of the right should be easy and possible at reasonable intervals to be aware of, and verify, the lawfulness of data processing (Recital 63). The Regulation further takes into consideration technological developments by stating that controllers should provide, where possible, remote access to a secure system that allows accessing personal data directly. Specifically, Article 15 of the Regulation sets out the right of access by the data subject regarding:- whether data concerning him/her is being processed and the specific contents of the information that can be accessed (including the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom data have been or will be disclosed, etc.) (Article 15(1)),
- whether personal data have been transferred to a third country or an international organization (Article 15(2)),
- the modalities of accessing data (copy of the data, administrative costs, electronic request) (Article 15(3)),
- limitations of the right of access through the modalities set out in Article 15(3) concerning the rights and freedoms of others (Article 15(4)).
- national security,
- defense,
- public security
- the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security,
- other important objectives of public interest of the Union or of a Member State, in particular, an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health, and social security,
- the protection of judicial independence and judicial proceedings,
- the prevention, investigation, detection, and prosecution of breaches of ethics for regulated professions,
- a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g),
- the protection of the data subject or the rights and freedoms of others,
- the enforcement of civil law claims.
Access to personal data in Turkey
In Turkey, the processing of personal data and the related rights and obligations of entities and individuals dealing with personal data are regulated by the Personal Data Protection Law No. 6698 (Kişisel Verileri Koruma Kanunu [KVKK]). The law came into force a couple of weeks before Reg 2016/679 on April 7, 2016 and was fundamentally modelled after Dir 96/46/EC to bring Turkish legislation on data protection in line with EU law. Consequently, the legislative developments on data protection currently in force in the EU are mostly reflected in the KVKK.Right of Access
Under the KVKK, each natural person whose personal data are processed can lodge an application (in writing or via other methods specified by the Personal Data Protection Board, including e-mail address which has been previously recorded in the data controller’s system) to the controller to exercise his/her right of access (Articles 2, 11 and 13 KVKK; Article 5 Communiqué on the Principles and Procedures for the Request to Data Controller [Communiqué]). Specifically, the right to access personal data under this law includes, inter alia, the right to:- learn whether his/her personal data are processed (Article 11(1)(a)),
- request information if his/her personal data are processed (Article 11(1)(b)),
- learn the purpose of data processing and whether data is used for intended purposes (Article 11(1)(c)),
- know the third parties to whom personal data is transferred in Turkey or abroad (Article 11(1)(ç)).
Limitations
General restrictions to the right of access can be found in the exceptions clause which limits the scope of the KVKK. Pursuant to Article 28(1), the KVKK does not apply in cases where personal data is processed:- by natural persons within the scope of purely personal activities of the data subject or of family members living together with him in the same dwelling if it is not to be disclosed to third parties and the obligations about data security is to be complied with,
- for the purpose of official statistics and for research, planning and statistical purposes after having been anonymized,
- with artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression provided that national defense, national security, public security, public order, economic security, right to privacy or personal rights are not violated or they are processed so as not to constitute a crime,
- within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations duly authorized and assigned to maintain national defense, national security, public security, public order, or economic security,
- by judicial authorities or execution authorities about investigation, prosecution, criminal proceedings, or execution proceedings.
- is required for the prevention of a crime or crime investigation,
- is carried out on the data that is made public by the data subject himself,
- is required for inspection or regulatory duties and disciplinary investigation and prosecution to be carried out by the public institutions and organizations and by professional associations having the status of public institution, assigned, and authorized for such actions, in accordance with the power conferred on them by the law,
- is required for protection of State’s economic and financial interests about budgetary, tax-related, and financial issues.
Access to personal data in Switzerland
In Switzerland, the processing of personal data through private persons and federal entities is centrally dealt with in the Federal Act on Data Protection Act (FADP) (except in limited circumstances, data processing by cantonal authorities is governed by cantonal law). The FADP came into force on 1 July 1993 and is currently undergoing a total reform (including a reform of the corresponding Ordinance to the Federal Act on Data Protection [FDPO] and other related legislative acts). The main aim of the total revision is to assure compatibility with EU legislation, thus allowing Switzerland to uphold its duties arising from the Schengen/Dublin cooperation agreement. Moreover, the new law aims to increase transparency in data processing with notable effects on mandatory information duties of data controllers and the data subjects’ right of access. The new Federal Act on Data Protection (nFADP) is expected to enter into force within 2022.Right of access
Under the law currently in force, the right of access to personal data is regulated by Article 8 FADP. Like the legislation in other jurisdictions, it foresees – upon request – the notification of, inter alia, available data, the purpose of and applicable legal basis for the processing of data as well as the categories of processed personal data (Art. 8(2)). The modalities to make a request are set out in Article 1 FDPO (in writing or online). Under Article 25 nFADP, the right of access to information is strengthened, notably in that certain information must be transferred to a data subject in any circumstance if so requested (Article 25(2) nFADP). This information includes, inter alia, the identity and the contact details of the responsible for the processing, details of the specific personal data and details concerning the uprose of processing (the list provided in Article 25(2) nFADP is non-exhaustive). Importantly, however, the new law states that such information must be provided only to the extent it is necessary to enforce the rights guaranteed under the present law. The request of data for other interests such as the procurement of evidence in civil proceedings would therefore be considered unlawful and may be rejected accordingly (BBI 2017 6941 pp. 7066 f).Limitations
The right of access is limited to data that is collected outside of the scope of the FADP. Notable limitations in this sense concern personal data processed by a natural person exclusively for personal use and which is not disclosed to outsiders as well as deliberations of the Federal Assembly and parliamentary committees (Article 2(2)(a) and (b) FADP). These and other ‘carve-outs’ are still present in Article 2 nFADP, although the modified Act enjoys a partially widened scope of application through certain amendments introduced for reasons of compatibility with EU legislation (see especially personal data in civil proceedings, criminal proceedings, international mutual assistance proceedings and proceedings under constitutional or under administrative law; BBI 2017 6941 pp. 7013-7015). Aside from the limitations of the scope of application, both the FADP and the nFADP include an explicit provision regulating the limitations of the right of access. Specifically, Article 9 FADP holds:- The controller of a data file may refuse, restrict, or defer the provision of information where:
- a formal enactment so provides,
- this is required to protect the overriding interests of third parties.
- A federal body may further refuse, restrict, or defer the provision of information where:
- this is required to protect overriding public interests, and in particular, the internal, or external security of the Confederation,
- the information would jeopardize the outcome of a criminal investigation or any other investigation proceedings.
- As soon as the reason for refusing, restricting, or deferring the provision of information ceases to apply, the federal body must provide the information unless this is impossible or only possible with disproportionate inconvenience or expense.
- The private controller of a data file may further refuse, restrict, or defer the provision of information where his own overriding interests so require, and he does not disclose the personal data to third parties.
- The controller of a data file must indicate the reason why he has refused, restricted or deferred access to information.
- formal enactment: describes provisions included in a law in the formal sense, thus functioning as lex specialis in relation to the right of access (i.e., laws mandating professional secrets such as for doctors or lawyers),
- overriding interests of third parties: targets situations when the relevant personal data includes (sensitive) information about a third party; the information cannot be automatically refused but a balance of interest must be performed on a case-by-case basis,
- overriding public interests: this non-exhaustive provision aims, inter alia, at the internal and external security of the State, the safeguard of external relations of the State, the safeguard of non-impaired decision making and will-formation, the safeguard of negotiation position or the execution of measures by official authorities,
- jeopardized outcome of a criminal investigation or any other investigation proceedings: in practice, this ground only has marginal importance as information on data is generally governed by the relevant procedural law (see Art. 2(2)(c) FADP),
- overriding interests of the private data controller: this provision only applies to private data controllers; the interests of the private data controller that could possibly override the interests of the requesting data subject include, for instance, data that combines personal and commercial secrets, a high financial burden of providing the data, or particularly sensitive data (i.e. a list containing people suspected of shoplifting established by the director of a warehouse); a limitation in this sense is only lawful if the relevant data is not disclosed to third parties which are understood as people that are not part of the same organizational or corporate structure.