Introduction
The Turkish Data Protection Authority
("DPA") on 27.05.2019 published through
its website a summary of its decision concerning a Turkish
state-owned bank, T.C. Ziraat Bankası A.Ş.
("Bank") [1]. This
is the third time[2] the DPA has published a
decision, in which a public institution is investigated, and the
first time the DPA has revealed the name of the concerned public
institution.
The decision is of importance as it draws the framework of the
"obligation to inform" under the Turkish
Personal Data Protection Law No. 6698 ("Data
Protection Law"). In addition, the DPA rarely
publishes the name of the data controller and this decision is an
example where the DPA has chosen to publish the name of the
responsible data controller, probably to raise awareness given that
the data controller subject to the investigation is a well-known
institution by the public.
