Author: Defne Pırıldar
Introduction
The Personal Data Protection Law numbered 6698 (“PDPL”) introduces definitions for many concepts such as personal data, data controller, data processor and data subject. In terms of understanding and interpreting these concepts, secondary legislation, Personal Data Protection Authority (“Authority”) guidelines and Personal Data Protection Board (“Board”) decisions play a key role. On the other hand, the concept of “joint controller”, which is frequently brought up in data processing activities but not included within the scope of the PDPL, was considered and referenced for the first time by the Board with its decision dated 23/12/2021 and numbered 2021/1303. Although the PDPL’s definition of data controller does not exclude the possibility of joint controllers, the decision addressing this concept for the first time, is noteworthy. In this Newsletter, the concept of joint controller will be discussed with respect to European and Turkish data protection legislation.
