The Concept Of Joint Data Controller In Turkish Legislation

With the principle decision of the Personal Data Protection Board ("Board") dated 23.12.2021 which was published on 20.01.2022, the definition of joint data controller which was not present in Turkish legislation is put in place.

While pursuant to GDPR a joint controller relationship arises where two or more controllers jointly determine the purposes and means of processing of personal data, Personal Data Protection Law or the secondary legislation did not include this concept. During the evaluation of a complaint with respect to the black list programs of vehicle leasing companies, the Board defined the joint data controller for the first time.

With this respect, while the leasing company that collects the personal data from customers is deemed as data controller, considering that other leasing companies which use blacklist programs can access and have control on the collected personal data, other leasing companies and software company which use the black list