The Personal Data Protection Authority [“Authority”] has published a public announcement on September 28, 2021, with respect to the collection and processing of PCR test results and information regarding vaccination status being shared with third parties to mitigate potential health risks during pandemic.
First, it should be mentioned that personal data regarding vaccination status and PCR test results qualify as ‘sensitive information’ pursuant to Article 6 of the Turkish Personal Data Protection Law No. 6698 [“Law No. 6698”], and one can process such data only upon obtaining explicit consent of the data subject. It was therefore, controversial as to whether explicit consent must be obtained from the data subjects while requesting information on PCR test results and vaccination status by employers, or by companies organizing public activities, such as concerts, theatres, cinemas, etc.
In its announcement, the Authority provided its response regarding these issues and indicated that collection, processing and recording health data relating to PCR test results and vaccination status do not constitute a violation under the relevant provisions of the Law No. 6698. By referring to the exception set out in Article 28/1 (ç), the Authority further stated that collection and processing of health data during the fight against Covid-19 should be considered inevitably required to maintain public health, public security and public order.
In this respect, according to the Authority’s announcement, it is permissible to request from persons participating in public activities to share information regarding their vaccination status and/or negative PCR test results. Similarly, workplaces/employers can collect, process and record health data of their unvaccinated employees who must take PCR tests once a week, without seeking their explicit consent. Nevertheless, activities that fall outside of the specified scope will still be subject to terms and conditions for processing health data as per the Law No. 6698.
By Zahide Altunbas Sancak, Partner, and Sevinc Jafarova, Associate, Guleryuz & Partners
