Data Protection Authority (“Authority”) has published a new decision on the date of 03.08.2018 (“Decision”).
As per the Decision, it is emphasized that data transfer between various data controller companies under the same enterprise system shall be accepted as a data transfer to a third party. In this respect, it is acknowledged that Article 8 of Data Protection Law with no. 6698 (“Law”) should be taken into consideration in the event of a data transfer between data controller companies under the same enterprise system.
In this context, due to violation of Article 12/1 of the Law, the Authority has imposed an administrative monetary fine according to Article 18 of the Law to a data controller company, which has shared personal data of a candidate -who has applied for a job- to another company under the same enterprise system, without explicit consent of such applicant.
In line with the explanations above, in order to share personal data (e.g. curriculum vitae) within the same enterprise system, explicit consent of data subject should be obtained for each company separately.
Please contact us if you have any queries.
Contributing Advisors
