Personal Health Data

The purpose of the Law on the Protection of Personal Data is to protect the privacy of private life in the processing of personal data (Art. 1). In the Law, any information relating to an identified or identifiable person is defined as personal data. Data belonging to a natural person whose identity is identified or identifiable are personal data. Data that would identify us when associated with us are considered personal data. In addition to information that is important in directly determining who we are—such as our name, surname, date/place of birth—information about our family, economic, and social situation is also personal data, since it can identify us indirectly.

According to the Law, personal data cannot be processed without the individual’s explicit consent. Accordingly, for personal data to be processed, the data subject must freely give approval for the processing of their data, having sufficient information about the matter.

Processing of personal data: Any operation performed on health data—such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making accessible, classifying, or preventing the use of personal data—by fully or partially automated means, or by non-automated means provided that it forms part of a data recording system. (KVKK Art. 3/e)

According to the Law, data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership in an association, foundation or trade union, health, sexual life, criminal convictions and security measures, as well as biometric data, are special categories of personal data.

According to the Regulation on Personal Health Data, any information relating to the physical and mental health of an identified or identifiable natural person, as well as information related to the healthcare service provided to the person, is personal health data. (KSVY Art. 4/j)

Personal health data may be processed with explicit consent and only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management, and financing of healthcare services, by persons under a duty of confidentiality or by authorized institutions and organizations (KVKK Art. 6/3).

Health Law Attorney Volkan Yalçınkaya