When briefly addressing the fundamental concepts of information law, we observe that law plays a crucial role in regulating information systems. It helps societies better utilize information by establishing, amending, and interpreting necessary legal rules while understanding the impact and actions of law on information technologies.
Data, by definition, refers to a collection of information or scientific data gathered through research, often numerical in nature, used for reference, analysis, or computation.
Turkish Personal Data Protection Law No. 6698, article 3/d: «Any information relating to an identified or identifiable natural person» This definition also overlaps with the definition in international regulations regarding the concept of personal data.
OECD (Organization for Economic Co-operation and Development) Definition in the guidelines dated 1980 and revised in 2013: «Personal data, means any information relating to an identified identifiable natural person»
GDPR (European Data Protection Regulation) article 4 «Personal data, means any information relating to an identified identifiable natural person
In addition, with the constitutional amendment made in 2010 by Law No. 5982, a provision was added to Article 20 of the Constitution, bringing personal data under constitutional protection as part of the "right to respect for private life." The relevant provision states: "Everyone has the right to demand the protection of personal data concerning themselves."
Unlike physical entities, data does not deplete with use. This characteristic highlights the importance of determining the legal nature of data.
Identifiability of Data
Data may not, on its own, directly identify an individual. However, when combined with other data, it may become identifiable, thus raising concerns related to identifiability.
Artificial Intelligence (AI) and Its Characteristics
Artificial intelligence refers to the development of algorithms and software enabling machines to think, analyze, interpret, and make decisions like humans. Significant advancements in AI techniques and applications have made AI-based systems an integral part of everyday life.
Reviewing the AI strategies of various countries reveals that AI impacts not only technology but also ethics and law. Key observations include:
Emerging Challenges: AI may infringe on privacy, make erroneous decisions, or result in discrimination.
Need for International Cooperation: The far-reaching effects of AI necessitate global collaboration.
Uncertainty about the Future: The rapid pace of AI development raises questions such as whether robots might have rights in the future.
In summary, to harness the benefits of AI, we must establish rules that ensure its fair and ethical use.
AI and Personal Data Protection
While AI generates significant benefits for individuals and society, it must be managed correctly to ensure the protection of personal data as a fundamental right. AI applications and studies involving personal data processing must comply with the Personal Data Protection Law (Law No. 6698) and related secondary legislation.
The Personal Data Protection Authority (KVKK) has published a guideline titled "Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence" to guide developers, manufacturers, service providers, and decision-makers in AI. This guideline emphasizes that personal data processing in AI and data collection must adhere to principles such as:
Legality, fairness, proportionality, accountability, and transparency.
Ensuring data is accurate and up-to-date.
Limiting data use to specific and legitimate purposes.
Implementing robust data security measures.
(Source: Personal Data Protection Authority, "Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence," p. 10, www.kvkk.gov.tr, Access Date: 15.03.2024).
Given the power of AI systems to analyze and use personal data, it is essential to safeguard individuals' rights under national and international regulations.
User Rights and Data Protection in AI
Users should have the right to halt data processing activities and ensure their data can be deleted, destroyed, or anonymized. Interacting individuals must be informed about the rationale for data processing, the methods used, and potential consequences. Additionally, an effective data processing consent mechanism should be designed for critical situations.
This article evaluates the relationship between AI applications and KVKK within the framework of the principle of purpose limitation, emphasizing key considerations for user privacy. For further details, please feel free to contact us.
