With the decision of the Personal Data Protection Authority dated 02.05.2023 and numbered 2023/711, it was decided that the processing of licence information for confirmation purposes is mandatory for the data controller to fulfil its legal obligation in order to ensure that the fee to be refunded is returned directly to the person.
——————————————————
Personal Data Protection Authority’s decision review regarding ‘’the erroneous taking of a toll payment from a toll pass by a highway operator from the applicant’’ dated 02.05.2023 and numbered 2023/711
The event subject to the judgement
As a summary of the applicant’s complaint, his highway pass tag of a vehicle belonging to the complainant was charged for a motorway he did not use, he contacted the highway operation (data officer) for a refund the the data controller requested copies of his identity card and licence for the refund, That herself applied to the data controller in accordance with Article 11 of the Personal Data Protection Law No. 6698 (“PDPL”) before herself application to the Personal Data Protection Authority, the data controller has not provided a satisfactory answer, and wants administrative fines from the data officer.
In summary of the data officer’s defence, “vehicle tracking systems can sometimes mistakenly charge tolls to the wrong tags, the photocopy of the licence is requested to ensure transaction security and the photocopy of the identity card is requested to match the pass information to the identity information, the practice of taking photocopies of identity cards has been stopped, However, the relevant information is shared with the General Directorate of Highways in accordance with the protocols and legal obligations between the General Directorate of Highways and the company, with regard to the data processing activity, layered clarification was made, therefore, stated that no administrative fine should be imposed”.
Applicable Legislation
The Institution referred to Article 77 of the Turkish Code of Obligations and stated that in the case subject to the complaint, the data controller accidently took the toll fee , and became liable for the refund of the fee, In this sense, in order to ensure that the fee to be refunded is returned to the right person, the processing of licence information for confirmation purposes is obligatory for the data controller to fulfil his legal obligations.
In addition, in Article 4 of the PDPL titled “General Principles”, ‘’stipulated in the relevant legislation or retained for the period necessary for the purpose for which they are processed’’ where there is a provision, In this context, as a requirement of the principle of purpose limitation, it is stated that personal data should be kept by the data officer for the period required for the purpose for which they are processed and that the data officer is obliged to take administrative and technical measures in this regard.
Conclusion and Judgement
The Authority, with the decision dated 02.05.2023 and numbered 2023/711, “In accordance with Articles 5, 11, 13 and 14 of the Personal Data Protection Law No. 6698 and Article 77 of the TCO (Turkish Code of Obligations);
-
In order to ensure that the fee to be refunded is returned directly to the person, when the fact that the processing of licence information for confirmation purposes is mandatory for the data controller to fulfil his legal obligation and the fact that the practice of obtaining identity information for confirmation purposes has been terminated together, there is no action to be taken within the scope of the Law regarding the complaint.
-
To remind the data controller that personal data should be kept for the period necessary for the purpose for which they are processed as a requirement of the principle of purpose limitation and that the data controller is obliged to take administrative and technical measures in this regard.
