With decision no. 2020/481 dated 23 June 2020, the Turkish Data Protection Board (the “Board”) ruled that requests for deletion and technical regulation enabling the de-indexing of search results based on an individual’s name and surname will be evaluated within the scope of the right to be forgotten. In this decision, the Board made assessments in parallel with the principles set forth in the European Court of Justice’s decision in the Google Spain case, and determined the criteria for the evaluation of the de-indexing requests.

Below is the brief summary of the Board’s decision:

• Although the right to be forgotten is not explicitly regulated under the law, the Board stated that the right to be forgotten would be conceptually considered within the scope of Article 20 of the Turkish Constitution, Articles 4, 7 and 11 of Turkish Law no. 6698 on the Protection of Personal Data (the “Law”) and Article 8 of the Regulation on Deletion, Destruction and Anonymization of Personal Data.

• Search engines are considered as data controllers, as they determine the purposes and means of the processing of third party data gathered on the internet. The activities of search engines qualify as “processing” under the Law, since a search engine operator automatically, regularly and systematically finds information on the internet and then organizes the same through its own indexing system.

• The Board stated that data subjects should first apply to the relevant data controller search engine for de- indexing requests, and that the form of the application and documents to be requested will be determined by the search engines. If the request is rejected or left unanswered, the data subjects may apply to the Board, and may also file a lawsuit at the same time.

• The Board indicated that in order to assess de-indexing requests, a balancing interest test should be conducted between the data subject’s fundamental rights and freedoms on the one hand, and the public interest to access the relevant information on the other hand, and that the prevailing interest should be taken into consideration. The annex to the Boards’ decision lists certain criteria which should primarily be taken into account in the course of this assessment, such as whether the data subject is a public figure; whether the subject of the search results is a child; whether the information is accurate, defamatory, outdated, or can put the data subject at risk; and whether the original content is comprised of data processed within the scope of journalism activities. The Board however emphasized that the relevant criteria are not limited to the ones mentioned above, and that additional criteria may be considered on a case-by-case basis.

• Lastly, the Board indicated that data controller search engine operators should adopt the necessary measures to enable Turkish citizens to use communication channels with said search engine operators in order to guarantee the implementation of the right to be forgotten on internet websites.