Abuse of Rights under the GDPR and the KVKK

Abstract

The boundaries of the abuse of rights doctrine under Article 12(5) of the General Data Protection Regulation (GDPR) are being redefined during the period when the Turkish data protection law is also being brought into alignment with the GDPR. The Court of Justice of the European Union has used its ruling in Brillen Rottler to reinforce the two-limb test, which stems from its rulings in the Halifax and Emsland-Stärke cases, as an expression of the prohibition of abuse of rights, a general principle of European Union law; the Digital Omnibus proposal, on the other hand, aims to rewrite this provision. Exceptions regarding the abuse of rights only apply to applicant requests in this structure, wherein an application can be rejected only if it is manifestly unfounded or excessive. Meanwhile, the interpretation of the Turkish Personal Data Protection Board (Board) applies this same concept not to the data subject but to the processing and notification behaviors of the data controller. Based on five decisions published by the Board, the study describes this shift as the addressee-shift tendency that is open to both verification and rebuttal; the study does not propose a universal category. Article 13/3 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) grants data controllers the right to refuse requests with justification but does not regulate the substantive conditions of this right; the threshold for requests that are manifestly unfounded or excessive has no equivalent in Turkish legislation. The attempt is being made to fill this gap through the principle of good faith (dürüstlük) in Article 6/1 of the Communiqué on Application to the Data Controller; however, Article 13 of the Constitution mandates legality and requires that content restricting a fundamental right be determined at the level of Kanun [law issued by Parliament] and not at the level of a Tebliğ [communiqué issued by the Authority]. The study proposes at the legislative level that the KVKK adopt the two-limb test established through Brillen Rottler, the rule of burden of proof on the data controller, and the good-faith standard of Article 6/1 of the Communiqué. The study bases this proposal on the interpretation in line with EU law, foreseeability, and the legality requirement under Article 13 of the Constitution of the Republic of Türkiye.