Privacy Law: Turkish Personal Data Protection Board’s Latest Ruling on Biometric Data Stored for Scientific Purposes

Turkish Personal Data Protection Board (“Board”) in its latest ruling, considered that the blood, serum, and tissue samples subject to complaint should be deemed as personal data since their storage conditions allowed for the identification of the patients, and that the process of recording these data by classifying them according to certain criteria was considered as personal data processing.

Background on Complaint

A doctor working in a hospital filed a complaint with the Board against the data controller, stating that the hospital acted in negligence in the protection of the destructed data and failed to fulfil its obligations regarding data security under related provisions of the Law on the Protection of Personal Data.

According to the complaint received by the doctor, doctors working in the data controller hospital started to record the data of patients clinically, with the experts and their associate assistants, by notifying the hospital administration. As per the complaint, some of these data were allocated in scientific research projects, after having obtained the consent of ethics committee. Thereupon, the doctors started to collect blood, serum and tissue samples belonging to patients in the deep freezers at -80 degrees. After leaving the hospital as a result of the end of the doctors’ temporary duty, the relevant hospital chief physicians were informed about the collection of these data.

However, according to the complaint received by the doctor, the deep freezers at -80 degrees were transferred to a room without air conditioning, then it was said that the substantial materials were melted, and the blood, serum, and tissue samples were destructed without any further investigation.

Data Controller’s Response

In response to the complaint, the data controller claimed that (i) information of patients were not disclosed with anyone other than the doctors working in patients’ cases and patients’ families so, the privacy of patients was ensured, (ii) refrigerators’ were damaged and the damage was reported, (iii) the hospital chief physician was informed regarding the situation and the materials in the refrigerators were destructed by the consent and instructions of hospital administration, and (iv) matching identity information did no longer have a scientific meaning because the samples were melted and destroyed.

The Board’s Approach

The Board firstly considered that in the light of the images and information attached to the complaint, the blood, serum, and tissue samples should be evaluated as personal data, since it is understood that these samples are placed in cabinets according to their names and eppendorf (tube) numbers. Therefore, the Board held that these samples could provide access to the identification of the patients and by thus, the process of registering these data by classification according to certain criteria should be considered as personal data processing.

However, the Board concluded that no action should be taken in response to the complaint. To elaborate, the Board resolved that the personal data processing should benefit from the exemption provided under related provision of the Law on the Protection of Personal Data since the blood, serum, and tissue samples were stored for scientific purposes and the storage of these samples did not violate requirements of national defense, security, public security, public order, economic security, privacy of private life or personal rights or did not constitute a crime.

Ezgi Ceren Aydoğmuş