Turkey's Data Protection Board Rules on Accident Victim Data Processing Amid Unsolicited Contact Complaints

Turkey's Personal Data Protection Board (KVKK) has issued a significant ruling concerning the processing of personal data belonging to accident victims. This decision comes in response to a surge in complaints regarding unsolicited contact from entities operating under names like "damage consultancy" or "insurance tracking centers."

“

In this context, it has become necessary to inform the public and the sector about the lawful execution of the personal data processing activities in question.

Many of these contacts were made by individuals claiming to be lawyers, who were later found not to be registered with any bar association. The KVKK highlighted that such practices, especially when involving personal data obtained without consent, are illegal. The board emphasized that compensation claims related to insurance can only be paid to the rightful claimant or their legally appointed lawyer.

The ruling clarifies that transferring these claims to third parties who are not lawyers, or to damage consultancy firms, is legally invalid. Furthermore, such actions could constitute a criminal offense under the Turkish Penal Code. The KVKK stated that individuals and institutions engaging in unlawful data processing or contacting victims for business purposes may face criminal prosecution and administrative penalties.

“

The transfer of these compensation claims arising from Law No. 5684 to third parties who are not lawyers or to formations operating under the names of damage consultancy companies or similar is legally invalid, and may also constitute a crime under Law No. 5237 of the Turkish Penal Code.

Victims who believe their personal data has been processed without authorization or shared with damage companies can file complaints with the KVKK. The board also noted that insurance adjusters can process personal data only within the scope of their legal duties, such as damage assessment and claims processing, adhering strictly to data protection laws and professional secrecy obligations.

“

Individuals and institutions that unlawfully obtain or share personal data, or offer business follow-up by contacting accident victims through this data, can be prosecuted in the Cumhuriyet Savcılıkları within the scope of Law No. 5237 of the Turkish Penal Code.