T
he Personal Data Protection Board (KVKK) in Turkey evaluated requests regarding the removal of search engine results for individuals’ names through its decision dated 23.06.2020, numbered 2020/481. This request, which considers the right to be forgotten as a higher-level concept, had previously been addressed in the Google Spain case bythe Court of Justice of the European Union. Let’s take a closer look at KVKK’s decision and the criteria it established for evaluating requests falling within the scope of the right to be forgotten.
Does Law No. 5651 Guarantee the Right to Be Forgotten?
First of all, in KVKK’s relevant decision, it was stated that while the concept of the right to be forgotten is not conceptually included in our legislation, there are regulations that can fulfill this request. It was mentioned that the regulation in Law No. 5651 regarding blocking access to content due to the privacy of personal life is also considered a regulation for fulfilling this right. However, the relevant article of Law No. 5651, which regulates the privacy of personal life, is considered applicable only in cases of ‘violation of personality rights’ according to decisions of the Court of Cassation. In this sense, it is not very likely that content that does not infringe on personality rights, is not illegal, and does not contain any elements of a crime can be removed with the regulation stipulated in Law No. 5651. On the other hand, the right to be forgotten represents a much broader concept, especially for content that an individual does not want to be known or associated with, even if it does not constitute a legal violation. Therefore, it is not likely that the regulation in Law No. 5651 regarding blocking access to content is an adequate regulation to establish the right to be forgotten.
Data Controller’s Obligation to Forget
The cessation of data processing activities aimed at establishing the right to be forgotten, through methods such as stopping, deleting, destroying, anonymizing, and de-indexing, can be decided based on the specific case, and thus, requests falling within the scope of the right to be forgotten can be fulfilled. The most important principles of data processing introduced by the Personal Data Protection Law include processing data in connection with the purpose for which it was processed and for a limited period. Thus, when the reasons necessitating the processing of personal data disappear, the storage of personal data is also intended to end. In this case, the data controller has an obligation to ensure the deletion of personal data by choosing the most suitable method among deletion, destruction, or anonymization. However, the option of ‘de-indexing’ mentioned in KVKK’s relevant decision is not an obligation imposed on data controllers. The fulfillment of the obligation to delete personal data under the Personal Data Protection Law may automatically lead to de-indexing. In this sense, it would be more accurate to state that data controllers have an obligation to forget, rather than individuals wanting to be forgotten.
Press freedom, archives, and more
The right to the protection of personal data must be evaluated in conjunction with other rights and freedoms, legal regulations in other laws, and constitutional regulations concerning individuals’ right to information, freedom of expression, and public order. In this sense, personal data protection and rights related to personal data must be evaluated along with all other regulations and rights, and they must pass through multiple filters. KVKK’s relevant decision also referred to this point and in the 13-item evaluation criteria published in the annex of the decision, it specified what should be considered when comparing these rights and freedoms. Accordingly, when evaluating an individual’s request within the scope of the right to be forgotten, requests targeting media organizations were primarily taken into account. In terms of the content that the individual wants to be forgotten, an assessment should be made regarding whether the information (personal data) that appears in search results is of a private, up-to-date, accurate, and lawful nature. However, for some of these criteria, a more careful evaluation is required, and therefore, clearer and more understandable guidelines should be provided. For example, how will it be determined whether the information reached in search results creates bias against the individual? How will it be assessed whether the information about the individual poses a risk of identity theft or tracking? Given the state of cyberattacks today, every piece of information or system has the potential to lead to such outcomes. Furthermore, the assessment of whether there is a legal obligation to publish information about the individual has been foreseen for public institutions, but there is no such legal regulation for public institutions.
Is the Target of the Right to Be Forgotten Search Engines?
Search engines index the contents available on websites and create search results accordingly. It should be noted here that the indexing performed by search engines is created by content providers. Content providers are defined in Law No. 5651 as natural or legal persons who produce, modify, and provide all kinds of information or data offered to users via the internet. Another definition in Law No. 5651 regarding websites is hosting providers, which are responsible for providing and operating systems that host services and content. Based on these definitions, those who provide the content indexed by search engines are content providers. In fact, in KVKK’s relevant decision, it was stated that when considering applications for the deletion of personal data from media organizations’ websites, press organizations are considered data controllers as the source of the content. As an additional note, content providers also have the option of not indexing the content they include on their websites. In this sense, it would not be incorrect to state that the indexing by search engines occurs not only by search engines themselves but also through content providers. However, in KVKK’s relevant decision, search engines were determined as the addressee for requests related to the right to be forgotten.
It is believed that the inability to identify or reach content providers of websites or the failure of content providers to respond to requests played a role in this determination. However, according to Law No. 5651, content, location, and access providers are obliged to keep their identifying information available to users in a way that can be accessed on their internet platforms within the framework of the principles and procedures specified in the regulation. Nevertheless, it is difficult to claim that this regulation is implemented in practice, that necessary regulations and inspections are carried out.
Can the Decision Be Implemented?
The determination of search engines as the addressees for right to be forgotten requests is expected to create some difficulties during implementation:
- The request submitted by the data subject to the search engine must be evaluated in accordance with the 13 criteria listed by KVKK. However, leaving the evaluation, interpretation, decision, and initiative for such a sensitive request to search engines will likely lead to many incorrect decisions, both for individuals and search engines.
- It is extremely challenging for search engines to keep up with requests regarding the content they index. This situation will delay the establishment of the right and cause individuals to experience rights violations. For instance, Google responds to the question, “How are you implementing the decision of the Court of Justice of the European Union (CJEU) regarding the right to be forgotten?” with the following statement: “The recent CJEU decision has far-reaching implications for search engines in the European Union. The court found that certain users have a right to ask search engines like Google to remove results for queries that include their name. To qualify, the results shown would need to be inadequate, irrelevant, no longer relevant, or excessive. Since this ruling was published on 13 May 2014, we’ve been working hard to get the right balance between the individual’s right to privacy and the public’s right to know. ….. However, it’s important to remember that removing a search result from Google doesn’t remove it from the web.”
- In cases where search engines do not respond to requests or do not provide a response, a path to apply to KVKK against the search engine will be opened. Although KVKK’s relevant decision mentioned the option of applying to the court, considering that search engines are based abroad, it is clear that the judicial process will be very challenging.
In summary, KVKK’s relevant decision should not be interpreted as meaning that all content and data containing individuals’ names and surnames will be removed from search engine results. It should be remembered that KVKK’s relevant decision needs to be evaluated separately for each case and individual, as underlined by KVKK itself. In terms of the implementation of the decision, it is clear that more practical and manageable regulations should be introduced to prevent violations of individuals’ rights.
