Processing Personal Data Based on Legitimate Interest: A Comparison of Turkish Data Protection Law, the Directive 95/46/EC and the GDPR

I. Introduction

Turkey's first and only law specifically dedicated to data protection and privacy, the Law No. 6698 on Protection of Personal Data ("Law No. 6698"), came into force on April 7, 2016 with certain transition periods. The Data Protection Board has been formed, but is not yet functioning. The secondary legislation is still pending, although certain sector-specific regulations have been put in place, and is expected to be completed by April 7, 2017.

The Law No. 6698 is essentially based on the EU Directive 95/46/EC ("Directive") with particular differences. As Turkey does not have a history of data protection laws and practice, the interpretations of the Directive in the EU will shed a light unto the interpretation of the Law No. 6698. That said, EU is in a period of transition to a new data protection regime and has recently introduced a game changer, the General Data Protection Regulation ("GDPR"), which will enter into force on May 25, 2018.