Unauthorized Disclosure or Acquisition of Personal Data

The crime of unlawfully providing, disseminating, or obtaining personal data is defined in Article 136 of the Turkish Penal Code. Article 137 outlines aggravated circumstances that increase penalties for this offense.

According to Article 136/1, any person who unlawfully provides, spreads, or obtains personal data is subject to imprisonment for 2 to 4 years.

If the subject of the crime involves recorded statements or images per the 5th and 6th paragraphs of Article 236 of the Code of Criminal Procedure, the penalty is increased by one level (Article 136/2).

Statements of children who are victims of offenses described in Article 103(2) of the Penal Code must be recorded in centers designated by the prosecution, under the supervision of experts. These recordings are made only when necessary during the investigation or trial process (Article 236/5 of the Code of Criminal Procedure).

Victims of crimes defined in Article 102(2) of the Penal Code can have their statements recorded with their consent (Article 236/6 of the Code of Criminal Procedure).

If the crime is committed by a public official using their authority or by exploiting the advantages of a specific profession or craft, the penalty is increased by half.

The primary legal interest protected by this offense is the right to privacy and protection of personal data.

According to the Law on the Protection of Personal Data, personal data refers to any information relating to an identified or identifiable natural person. Examples include:

• Name, surname, birthdate, birth place
• Phone number, vehicle license plate
• Social security number, passport number
• Residential address, marital status
• Criminal record, bank account information
• Health information, ethnicity, political views
• Philosophical and religious beliefs, DNA information
• Photos, videos, fingerprints, etc.

Unauthorized Provision of Personal Data: The act of offering personal data unlawfully to another person.

Unauthorized Dissemination of Personal Data: The act of making personal data available to multiple people or distributing it to the public unlawfully.

Unauthorized Acquisition of Personal Data: The act of obtaining personal data from another person, either without consent or under false pretenses.

If a person records personal data unlawfully and subsequently provides it to someone else, they are guilty of both recording personal data unlawfully (Article 135) and unauthorized provision of personal data (Article 136).

The offense is not dependent on a complaint to be investigated or prosecuted.

The presence of the victim's consent negates the crime.

Using someone else's photo from social media to create a fake account is considered a violation of personal data. Even if the images are publicly accessible, this does not grant the right to use them without legal consequences.

If the perpetrator’s occupation or profession facilitates the crime of unauthorized use of personal data, this constitutes an aggravating factor.

Bayar Law Office provides consultation and legal services in criminal law matters.