By-Law On The Identity Information System

By-Law On The Identity Information System

The by-law on the Identity Information System has been published in the Official Gazette on 21.08.2020. Within the framework of the by-law, the General Directorate of Civil Registration and Citizenship Affairs of the Ministry of Interior ("General Directorate") regulate the procedures and principles regarding the data sharing contained in the central database with the recipient institutions.

Pursuant to Article 4 of the by-law, recipient institutions are defined as follows: “Institutions and legal entities, which provide public services other than the General Directorate, benefiting from the Identity Information Sharing System". Accordingly, the recipient institutions herein are entitled to access to the relevant persons’ information contained in the central database, provided that they do comply with the conditions set forth under the provisions of the by-law.

Recipient institutions will access the data and documents through a portal provided by the General Directorate, and the data that the recipient institutions are entitled to obtain will be sent to them after the query. In the event that the recipient institutions request for additional authorization, justification and legal grounds of this request shall be specified.

Substantial Provisions of the By-Law

Provisions of the by-law that are significant in terms of practices concerning the protection of personal data are listed below:

• Recipient institutions shall only be able to obtain the data of the relevant persons as the basis for their own duty and transactions, and the obtained data cannot be used for any other purposes other than performing the defined services.
• Recipient institutions seeking to benefit from the Identity Information Sharing System -the system where data contained in the central database is shared with the recipient institutions- will make a request to the General Directorate in writing or electronically. While doing this, the justification for using the requested data should be explicit and based on concrete facts, the legal grounds for the institution to receive such data is specified, and the documents requested by the General Directorate are submitted.
• Requests to be made will be evaluated by the Data Sharing Board (“Board”) -which has been established to evaluate such requests regarding the data sharing- and the Board may reject the requests that are not deemed appropriate by expressing the relevant reasons.
• Recipient institutions, whose applications are deemed appropriate by the Board, shall declare in writing that they have taken all necessary administrative and technical measures to ensure the appropriate level of security determined by the General Directorate. The recipient institutions will be held liable for the continuity and accuracy of the declared administrative and technical measures within this framework.
• In the event that the security measures determined by the General Directorate are not met, the recipient institutions will be notified about current situation, and if the deficiencies are not corrected within 60 days, the relevant request shall be rejected.
• A letter of undertaking shall be signed by the recipient institution whose request is deemed appropriate. The General Directorate will share the data contained in the central database, after the the letter of undertaking is duly signed in accordance with the procedures and principles specified under the by-law. Relevant matters in question to be included in this letter of undertaking are as follows:

• Purpose for accessing the data
• Legal ground for accessing the data
• Method and duration for accessing the data
• Duties and powers
• Legal liability
• Administrative and technical measures to be taken
• Other matters

Protection of the Data to be Accessed

The procedures and principles regarding the protection of the data belonging to relevant persons and contained in the central database of the General Directorate are determined under Article 9 of the by-law. According to this;

• The provisions under relevant legislations regarding the right to privacy and the protection of personal data shall constitute the basis during the use of the Identity Information Sharing System.
• The recipient institutions will not be entitled to use the data obtained for any purpose other than fulfilling their duties and responsibilities specified in the relevant legislation, and such data can be used in line with the principles specified under the letter of undertaking. The recipient institutions shall ensure the protection of the data that they obtained and take all necessary administrative and technical measures in order to prevent any potential violation.
• Recipient institutions shall be held liable for the uses of such data obtained through the Identity Information Sharing System.
• All kinds of legal, financial and criminal liabilities arising from the improper use of the data obtained from the Identity Information Sharing System contrary to the provisions of the relevant legislation and the letter of undertaking, obtainment and use of the data by unauthorized persons due to erroneous inquiries and security gaps resulting from the systems software of the recipient institution shall be assumed by the recipient institution.
• Recipient institutions shall be obliged to comply with the procedures and principles specified under the Law on the Civil Registration Services and the Law on Protection of Personal Data No.6698, and to monitor the transactions made by the users within the scope of these principles.

Monitoring, Auditing and Evaluation of Recipient Institutions’ Transactions

The Directorate General shall take all necessary administrative and technical security measures in order to prevent unlawful processing and access to personal data, and shall monitor and audit the recipient institutions to take these measures.

If it is detected that the administrative and technical security measures undertaken by the recipient institution are not fulfilled, the Identity Information Sharing System will be closed for use and the letter of undertaking may be unilaterally invalidated. In addition, if it is detected that the protection and security of the obtained data is directly or indirectly at stake, the authorization to access the Identity Information Sharing System of the recipient institution will be suspended.

In addition, if it is detected that personal data are processed unlawfully, necessary actions will be taken in accordance with the relevant provisions of the Law on Protection of Personal Data No. 6698.

The content herein is aimed at providing a general insight regarding the subject. For customized circumstances or further information, please refer to your lawyer.