Processing of Special Categories of Personal Data

In the Law, special categories of personal data are defined in a limited manner as data related to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, attire, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, security measures, as well as biometric and genetic data.

Before the enactment of the Amendment Law, the processing of special categories of personal data under the Law was primarily conditioned on obtaining the explicit consent of the data subject, and processing such data without explicit consent was almost legally impossible. In practice, when it was not possible or practical to obtain explicit consent, processing special categories of personal data became a problematic area. Moreover, considering that explicit consent was legally required to be the last resort legal basis, it created an extremely unhealthy legal situation. In the period before the amendments, there was a need to expand the restrictive conditions for processing special categories of personal data, as well as to address the distinction between personal data related to health or sexual life and other special categories of personal data, which was a subject of discussion in practice.

With the enactment of the Amendment Law, which aims to address the bottleneck experienced in practice and align with European and GDPR standards, the conditions for processing special categories of personal data have been expanded, and the distinction between personal data related to health or sexual life and other special categories of personal data has been removed.

As a result, under the additional legal grounds specified, it has become possible to process all special categories of personal data without requiring the explicit consent of the data subjects.

Accordingly, all special categories of personal data (including health data and personal data related to sexual life) may only be processed if one of the following conditions is met:

• The explicit consent of the data subject is obtained,
• It is expressly stipulated by laws,
• It is necessary for the protection of the life or physical integrity of the data subject or another person who is unable to give consent due to physical impossibility, or whose consent is not legally valid,
• It is relevant to personal data publicized by data subject and is in accordance with the intention of data subject of making it public,
• It is necessary for the establishment, exercise, or protection of a right,
• when processing is compulsory by persons under the secrecy obligation or competent authorities or institutions for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning, management, and financing of health services,
• It is necessary for fulfilment of legal obligations relating to employment, occupational health and safety, social security, social services, and social benefits,
• where foundations, associations, and other non-profit organizations or formations established for political, philosophical, religious, or trade union purposes, provided that it is in accordance with the relevant legislation to which these organizations are subject and aligned with their stated purposes, processing is limited to their field of activity, and data is not disclosed to third parties; processing pertains to their current or former members, affiliates or individuals who are in regular contact with these organizations and formations

In the period before the amendment, data controllers processing special categories of personal data were often required to rely on explicit consent as the legal basis for most processing activities. With the amendment, however, it has become possible for data controllers to base their processing activities on different legal grounds in most cases. Legal grounds such as clear stipulation in laws, the necessity of data processing for the establishment, exercise, or protection of a right, and the necessity of fulfilling legal obligations in the areas of employment, business and social security, or social services are emerging as innovations that can help data controllers overcome the challenges they faced in practice.

In the context of employee-employer relationships, the need to process employees’ special categories of personal data due to necessity was, prior to the legislative change, only possible with explicit consent. This created operational challenges and raised debates about the validity of consent in a relationship where the employee is dependent on the employer and whether the consent could truly be given freely. With the amendment, these issues have been resolved. As a result, employers who collect and process employees' health data in the context of occupational health and safety obligations can now rely on the legal ground of "the necessity for fulfilling legal obligations in the areas of employment, occupational health and safety, social security, social services, and social assistance", and will no longer need to obtain explicit consent.

Therefore, it is crucial for data controllers to update their existing compliance practices to align with the new framework for processing special categories of personal data. In particular, they should revise their data processing policies, privacy notices, and explicit consent practices to reflect the latest legal requirements. Additionally, they must carefully assess the newly defined legal bases on a case-by-case basis for each processing activity.

First published by Gün + Partners in Mar 04, 2025.