In our country, the Public Inspectorate Institution was established on June 14, 2012, with the Law No. 6328 on the Public Inspectorate Institution, and began accepting applications nine months after the law was published. The purpose of the law is defined in Article 2 as follows: “to establish an independent and effective complaint mechanism in the operation of public services, to examine, investigate, and make recommendations regarding all actions and procedures of the administration and its attitudes and behaviors within the understanding of justice based on human rights, in terms of compliance with the law and fairness.” Following the law, on March 28, 2013, the “Regulation on the Procedures and Principles Regarding the Implementation of the Law on the Public Inspectorate” was published in the Official Gazette No. 28601 and came into effect. The institution is affiliated with the Grand National Assembly of Turkey, possesses public legal personality, has a special budget, and is located in Ankara. The institution’s duty is to examine, investigate, and make recommendations to the administration regarding all actions and procedures and attitudes and behaviors of the administration in relation to complaints about the functioning of the administration; this is done within the understanding of justice based on human rights, in terms of compliance with the law and fairness. Actions related to the exercise of legislative authority, decisions regarding the exercise of judicial authority, and purely military activities of the Turkish Armed Forces are outside the institution’s scope. Real and legal persons can apply to the institution. Disputes that do not involve a specific issue, are pending in judicial bodies, or have been decided by judicial bodies will not be examined. To make an application to the institution, it is necessary to exhaust the administrative application channels provided for in the Administrative Jurisdiction Procedure Law and the mandatory administrative application routes specified in special laws. The institution may accept applications even if the administrative application channels have not been exhausted, in cases where there is a possibility of irreparable or impossible harm. Regarding administrative procedures, if the application is made within thirty days from the notification of the final administrative action and the administration does not respond within thirty days, an application can be made to the institution within six months from the end of the thirty-day period. An application made within the lawsuit filing period will pause the lawsuit filing period. During the examination process of the application, the chief auditor, deputy chief auditors, or experts may listen to witnesses and consult experts if deemed necessary. The institution will conclude its examination and investigation within a maximum of six months from the date of the application. As a result of its examination and investigation, the institution will issue a recommendation decision, a rejection decision, a friendly settlement decision, or a decision that no further action is required. The institution will notify the relevant authority and the applicant of the recommendation decision containing the results of the investigation and the proposed solution. If the relevant authority does not find the solution proposed by the institution applicable, it must notify the institution of the reason within thirty days. If the application is rejected by the institution, the paused lawsuit filing period will resume from where it left off, starting from the notification of the reasoned rejection decision to the concerned party. If the application is accepted by the institution as valid, if the relevant authority does not take any action or does not establish any process within thirty days based on the institution’s recommendation, the paused lawsuit filing period will continue from where it left off.
Since the institution became operational, there is a decision dated March 9, 2020, with application number 2019/16891 regarding the protection of personal data. The decision was given partly as a recommendation and partly as a rejection. The subject of the decision includes the complaint that “the yellow press card, which is an official identification document issued by the former Prime Ministry and currently by the Presidency of Communications, was not accepted as an official identification document at a private bank where the applicant went to make a banking transaction (school installment payment); moreover, the banking transaction was not carried out because the applicant did not share their mobile phone number, and that the mobile phone information falls within the scope of personal data according to current legislation, and no one can be forced to share their personal data under pressure.” The applicant requested the “suspension of the practice of unlawfully requesting citizens’ personal data by banks and ensuring that these institutions accept the yellow press card as an official identification document during their transactions.” Regarding the request for the acceptance of the press card as an official identification document during banking transactions, the application was rejected. However, regarding the claim of unlawfulness of requesting mobile phone information, which is personal data in banking transactions, the application was accepted, and it was decided to recommend to the Banking Regulation and Supervision Authority the necessary actions, and to notify the Presidency of Communications, the Financial Crimes Investigation Board, and the Personal Data Protection Authority for information.
In evaluating the legality of requesting mobile phone information, the decision stated that:
“Mobile phone information is personal data, the obtaining and use of mobile phone information constitutes the processing of personal data, banks are data controllers, and the individuals whose mobile phone information is processed are the relevant persons. Therefore, the processing of mobile phone information of the relevant person by banks must be carried out in accordance with the procedures and principles specified in Article 4, titled ‘General Principles’ of Law No. 6698.”
“The principle of ‘processing personal data for specific, explicit, and legitimate purposes’ indicates that the data processed by the data controller can only be processed in connection with the work they have done or the service they have provided, and only if necessary.”
“According to the principle of ‘related to the purpose for which they are processed, limited, and proportionate’, there should not be data processing activities for needs that are not related to the realization of the purpose or for potential future needs.”
“As a requirement of the ‘purpose limitation principle’, personal data must be retained only for the time necessary for the purpose for which they are processed.”
“Personal data cannot be processed without the explicit consent of the relevant person. During the collection of personal data, the data controller or the authorized person must fulfill their obligation to inform the relevant persons about the personal data processing activity and must take all necessary technical and administrative measures to ensure the appropriate level of security as regulated in Article 12 of the Law.”
By stating these reasons, it was assessed that “the mobile phone number is not among the mandatory information required for identity verification of the applicant customer; the application to obtain this information violates the provision in Article 4, paragraph 2 of the Law No. 6698 on the Protection of Personal Data, which states that ‘it is mandatory to comply with the following principles in the processing of personal data: a) Compliance with the law and honesty … c) Processing for specific, explicit, and legitimate purposes. c) Being related to the purpose for which they are processed, limited, and proportionate. …’”[1]
Attorney Yalçın Torun
© 2025 Torun Law Firm – All Rights Reserved.
This article is protected under the provisions of the Law on Intellectual and Artistic Works (No. 5846). The content, in whole or in part, may not be copied, reproduced, published, or shared on any other website without the prior written permission of the author and Torun Law Firm.
This material may only be shared by licensed attorneys, for professional purposes, without any modifications, and with full attribution to the author and the source.
Any unauthorized use may result in legal and criminal liability.