Turkey's Law on The Protection Of Personal Data (DPL) incorporates the Automated Means Criterion as a key factor in determining the law's applicability to data processing activities.

Text of Relevant Provisions

DPL Article 2:

"The provisions of this Law shall apply to natural persons whose personal data are processed and to natural or legal persons processing such data wholly or partially by automated means or by non-automated means which provided that form part of a data filing system."

Analysis of Provisions

The Automated Means Criterion is explicitly included in Article 2 of Turkey's DPL, which defines the scope of the law's application. The provision states that the law applies to the processing of personal data "wholly or partially by automated means". This criterion extends the law's applicability to a wide range of data processing activities that involve any degree of automation.

The inclusion of the phrase "wholly or partially" is significant as it indicates that even if only a portion of the data processing is automated, the law still applies. This broad interpretation ensures that the law covers a wide spectrum of data processing activities, from fully automated systems to those that combine automated and manual processes.

It's important to note that the law also applies to non-automated processing, but only when it forms part of a data filing system. This additional clause ensures that structured manual filing systems are also covered by the law, preventing potential loopholes that could arise from relying solely on the automated means criterion.

Implications

The inclusion of the Automated Means Criterion in Turkey's DPL has several important implications for businesses and organizations:

1. Wide applicability: Almost all modern data processing activities involve some degree of automation. This means that most businesses handling personal data in Turkey are likely to fall under the scope of the DPL.
2. Technological neutrality: By not specifying particular technologies, the law remains flexible and applicable to both current and future automated processing methods.
3. Partial automation is sufficient: Organizations cannot avoid compliance by arguing that only part of their processing is manual. Even partial use of automated means triggers the law's application.
4. Manual processing not excluded: While the Automated Means Criterion is a key factor, the law also covers non-automated processing when it's part of a structured filing system. This prevents organizations from circumventing the law by reverting to manual processes.
5. Compliance requirements: Businesses must ensure that all their automated data processing activities, no matter how minor, comply with the DPL's provisions.
6. Data filing systems: Organizations need to assess whether their non-automated processing forms part of a data filing system, as this would also bring such processing under the law's scope.