What is Personal Data?
The concept of personal data is defined in our legislation under Article 3/1-d of Law No. 6698 on the Protection of Personal Data as: “any information relating to an identified or identifiable natural person.” Similarly, in Article 4 of the EU General Data Protection Regulation (GDPR), it is defined as “any information relating to an identified or identifiable natural person.”
According to this article, an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
The Crime of Unlawful Disclosure or Acquisition of Personal Data
The recording of personal data, its unlawful disclosure to another person, or its acquisition is regulated as a crime under Articles 135 and following of the Turkish Penal Code No. 5237, in Chapter Nine titled “Crimes Against Privacy and the Confidential Sphere of Life.”
According to Article 136 of the Code: “Any person who unlawfully discloses, disseminates, or acquires personal data shall be sentenced to imprisonment from two to four years.”
Aggravated Circumstances
Article 136/2 of the Turkish Penal Code stipulates that if the personal data in question consists of statements and images recorded pursuant to paragraphs five and six of Article 236 of the Criminal Procedure Code, the penalty shall be increased by one fold. The relevant provisions of the Criminal Procedure Code cover children and victims of sexual assault.
Again, pursuant to Article 137 of the Turkish Penal Code, if this offense…
- If the offense is committed by a public official through abuse of the authority conferred by their position,
- by taking advantage of the facilities provided by a certain profession or art, the penalty shall be increased by one half.
Is the Crime of Unlawful Disclosure or Acquisition of Data Subject to Complaint?
The investigation or prosecution of the crime of unlawful disclosure or acquisition of data is not subject to a complaint and is pursued ex officio.
Is the Crime of Unlawful Disclosure or Acquisition of Data Subject to Mediation?
The crime of unlawful disclosure or acquisition of data is not subject to mediation.
Offender and Victim
The victim of the crime of unlawful disclosure or acquisition of data can only be a natural person. Similarly, the offender of the crime regulated under Article 136 of the Turkish Penal Code is also a natural person. However, pursuant to Article 140 of the Turkish Penal Code, specific security measures may be imposed on legal entities in relation to the commission of crimes.
Statute of Limitations
Since the crime of unlawful disclosure or acquisition of data is not subject to a complaint, it is subject to the general statute of limitations, which is 8 years.
Suspension of Sentence
Pursuant to Article 51 of the Turkish Penal Code: “The sentence of a person sentenced to imprisonment for two years or less for the crime they committed may be suspended.” Therefore, in the case of the relevant offense, if the sentence is imposed at the lower limit, the suspension of the sentence may be decided.
Judicial Fine
In cases where a reduction in the sentence is applied, the crime of unlawful disclosure or acquisition of data may, under certain conditions, be converted into a judicial fine.
Suspension of the Announcement of the Verdict (Conditional Suspension of Sentence, HAGB)
If a sentence of two years or less is imposed for the relevant offense, the announcement of the verdict may be suspended. In order for a HAGB decision to be made:
- The defendant must not have been previously convicted of an intentional crime.
- The court must be convinced, taking into account the defendant’s personality traits and behavior during the trial, that they will not commit another offense.
- The damage suffered by the victim or the public as a result of the crime must be fully remedied, either by restoration, returning to the pre-offense state, or compensation.
Precedent Decisions
“The defendant accessed and viewed personal data under their control using the device and password provided by the institution. It was concluded that the defendant’s act, which merely involved viewing data under their own control, cannot be considered as acquisition. While such an act may be subject to a disciplinary investigation under the internal regulations of the relevant institution, it does not constitute a crime under the Turkish Penal Code…”
Accordingly, it has been evaluated that individuals working in public institutions, who are granted access to personal data in the institution’s information systems as part of their duties, do not commit a crime under the Turkish Penal Code if, without any connection to the performance of their duties, they query personal data in the system out of curiosity, interest, or other motives, or simply become aware of this data through their senses.
(Court of Cassation, 12th Criminal Chamber, 2022/7211 E., 2025/309 K., 09.01.2025)
“In the case where the defendant gave the phone number, which constitutes personal data, of his ex-girlfriend (the complainant) to another defendant without the complainant’s consent; failing to recognize that the acts of the defendant who unlawfully disclosed the complainant’s phone number and the other defendant who unlawfully acquired it constitute the crime of unlawful disclosure or acquisition of data, and instead acquitting them with the erroneous reasoning that ‘the act of giving a phone number cannot be considered as acquisition or dissemination of personal data,’ is contrary to the law.”
(Court of Cassation, 12th Criminal Chamber, 2014/607 E., 2014/16665 K., 07.07.2014)
“The defendant stated that the social media account was opened together with the victim and that the photos were uploaded together, and that no activity was performed on the account after their separation. Given that the dates when the account was opened and activity was performed could not be determined from the social media page screenshots, that no physical evidence was found after seizing and examining the hard drives of the defendant’s computer, and that, due to the elapsed time, it is unlikely that new evidence could be obtained through further examination, there is, contrary to the defense, no sufficient, definitive, reliable, and convincing evidence to support a conviction. Therefore, the defendant should have been acquitted, and issuing a conviction with written reasoning is contrary to the law.”
(Court of Cassation, 12th Criminal Chamber, 2014/18327 E., 2015/2130 K., 09.02.2015)
*”According to the file; in the incident where defendant A., believing that her boyfriend had cheated on her with defendant D., registered on a social media site under the name “O. E.” and created an email account on that site, uploaded a photo of another woman showing cleavage, and included the phone number of defendant D., resulting in defendant D. receiving sexually explicit friendship proposals from unknown persons calling his phone, upon learning that it was defendant A. who had disclosed his phone number, he provided the phone number used by defendant A. to unknown persons claiming he had changed his number. Subsequently, both defendants were disturbed by calls from unknown persons and filed complaints against each other, which they later withdrew.
Despite the fact that, pursuant to Article 139/1 of the Turkish Penal Code, the crime of unlawful disclosure or acquisition of data is not subject to a complaint, a written dismissal decision was issued at the prosecution stage on the grounds that both victims had withdrawn their complaints.
This is contrary to the law. Since the objections to the appeal by the local public prosecutor are justified, the judgment is hereby REVERSED in accordance with Article 321 of the CMUK No. 1412, currently in force under Article 8 of Law No. 5320, for the stated reason.”*
(Court of Cassation, 12th Criminal Chamber, 2012/22005 E., 2013/24489 K., 04.11.2013)
Lawyer. Gökhan AKGÜL & Lawyer. Züleyha APAYDIN
Antalya Criminal Lawyer – Antalya Criminal Law Attorney
The unlawful disclosure, dissemination, or acquisition of personal data is among the crimes subject to severe sanctions under the Turkish Penal Code. Especially with the increase in data security breaches in digital environments, investigations related to such crimes have also intensified. Working with an experienced criminal lawyer in Antalya in this field is of great importance, both for preventing victimization and for ensuring effective legal proceedings. Our law firm provides professional consultancy and representation in cases related to the protection of personal data and criminal law, aiming to prevent any loss of rights. We are here to assist you in your search for a data security lawyer in Antalya.
