Within the scope of the Law No. 6698 on the Protection of Personal Data ("Law"), the Turkish Republic Identity Number ("T.R. ID Number") information of individuals is not included in the category of sensitive personal data, but rather is evaluated within the scope of identity data in the general category of personal data. However, in practice, the direct processing of the T.R. Identity Number data while the same data processing purpose could be achieved by processing different data has been subject to criticism due to the fact that the T.R. ID Number is a type of data that can provide access to other personal data of the data subject.
It is without doubt that the processing of T.R. ID Numbers should be approached with particular sensitivity. Indeed, the Personal Data Protection Board ("Board"), in a recent decision[1] on the processing of the T.R. ID Number in the mobile application of the data controller who provides meal card services, evaluated that although the T.R. ID Number is included in the general category of personal data, it is more important than other personal data of general category and may cause greater damages in case of a data breach for the data subjects. In the relevant decision, it was determined that the same purpose could be achieved by processing other data that do not restrict as much rights of the data subjects without processing the T.R. ID Number, thus, the principle of being related, limited and proportionate to the purpose for which personal data are processed, which is one of the general principles specified in the Law, was violated.
Following the fact that the T.R. ID Number is directly processed by data controllers in many cases in violation of the general principles of the Law, although different methods are possible in practice, and the increase in criticisms and complaints made in this direction, the Personal Data Protection Authority (“Authority”) published the Guideline on the Processing of Turkish Republic T.R. ID Numbers ("Guideline") on 16 January 2024 in order to inform the public about the issues that should be considered in the processing of the T.R. ID Number. You can access the Guideline here.
In the Guideline, it has been determined that the T.R. ID Number is official, unique and unchangeable and that it is preferred to be processed by data controllers since it provides convenience in accessing other personal data of the data subjects. However, in parallel with the Board's decisions, it is assessed that although the T.R. ID Number is not among the sensitive categories of personal data, it is likely to have negative effects on the data subjects due to its nature that enabled access to other related personal data, and therefore, it has a higher importance than general categories of personal data, even though it belongs to the very same category.
In the Guidelines, the principle that personal data should be related, limited and proportionate to the purpose for which they are processed, which is one of the general principles under Article 4 of the Law, is explained, and it is assessed that while it was possible to achieve the same purpose by processing other personal data, the processing of the T.R. ID Number would constitute an intervention that further limits the right of the data subjects to request the protection of their personal data and would violate the principles of necessity and proportionality. Accordingly, in the Guidelines, while the purpose of verifying the identity of a person in a mobile application can also be achieved with a phone number, the processing of the T.R. ID Number for verification purposes is exemplified as contrary to the principles of necessity and proportionality, and it is emphasized that methods that interfere less with the right to protection of personal data of data subjects, if any, should be preferred in the processing of the T.R. ID Number.
In the remainder of the Guideline, in order to provide guidance, the cases where the processing and submission of the T.R. ID Number for data processing activities to be carried out is legitimate on the condition that it is clearly stated in the law are listed below.
|
Cases where the processing of the T.R. ID Number is stipulated |
Cases where the submission of the T.R. ID Number is stipulated |
|
Issuance of Invoices for Goods and Services |
Shareholders’ Participation in the General Assembly of a Company |
|
Order and Cargo Delivery |
Distance Contracting |
|
Delivery of Postal Shipments
|
Voting in General and Local Elections |
|
Complaint Applications to Intermediary Service Providers in Electronic Commerce |
Voting in the Organ Elections of the Union of Chambers and Commodity Exchanges of Turkey and Commodity Exchanges |
|
Sending Commercial Electronic Messages by Tradesmen |
Voting in Trade Union Elections |
|
Filing a Complaint to the Ministry of Trade Regarding Commercial Electronic Messages by Natural Persons |
Notification of the Identity of the Trade Union Representative to the Employer
|
|
Registration in the Trade Registry and Registry Certification |
Identification Procedures Performed by the Notary |
|
Within the Scope of Local and General Elections, Suspension of Voter Lists, Sharing with Political Parties Qualified to Run for Election |
Identification Procedures in Health Service Providers |
|
Filing Enforcement Proceeding Requests
|
Identification and Notification of the Responsible Operators of Private or Public Accommodation, Recreation, Care and Treatment Facilities, All Workplaces for the Purposes of Trade and Art and Student Dormitories, as well as those who work and reside in such places; Authorized Supervisors of Public Offices; Identification and Notification of the Identities of Those Who Stay, Work or Change Their Residence Permanently or Temporarily in Dwellings |
|
Legal Transactions Performed at Notary Public |
Electronic Payment Services |
|
Registration in the Land Registry |
Identity Verification Activities in the Electronic Communication Sector |
|
Petitions for Filing a Lawsuit, Appeal, Appeal, etc. |
Betting on Sports Competitions and Winning Jackpots |
|
Keeping Family Registers |
Winning Jackpots in National Lottery Drawings |
|
Divorce and Annulment of Marriage |
Authorization of Law Enforcement Officials to Ask for Identity |
|
Identifying Documents Issued to Natural Persons Identity |
Verification with Biometric Methods in Private Hospitals |
|
Sharing of Identity Information by the Ministry of Interior within the scope of Law No. 5490 |
|
|
Identity Sharing System |
|
|
"Use of Code White" by Physicians and Healthcare Workers |
|
|
Transactions of Insured Persons within the Scope of Social Insurance and General Health Insurance |
|
|
Trade Union Establishment |
|
|
Airline Ticket Issuance |
|
|
Scheduled/non-scheduled passenger transportation and ticketing on highways |
|
|
Obtaining and Renewing Authorization Certificates for Cargo Transportation on Highways |
|
|
Ticketing for Travel, Events and Sports Competitions |
|
|
Mass Customer Acceptance within the Scope of Salary Payment |
|
|
Prevention of Laundering Proceeds of Crime |
|
|
Data Sharing among the Members of the Turkey Risk Center of Banks Association |
|
|
Number Porting |
|
|
Working or being a Member in Sports Halls/Facilities |
|