Evaluations contained in the Personal Data Protection Board’s decision dated 22.07.2020 and numbered 2020/560 related to building complex managements

The Personal Data Protection Board’s (“the Board”) decision summary, which bears the heading “Evaluations contained in the Personal Data Protection Board’s decision dated 22.07.2020 and numbered 2020/560 within the framework of the Law numbered 6698 on the Protection of Personal Data and the Condominium Law numbered 634, related to Building Complex Managements”, is published on the Authority’s official website.    

Within the framework of the Law numbered 6698 on the Protection of Personal Data (“the PDPL”) and the Condominium Law numbered 634 (“the CL”); the decision carries out the following evaluations within the scope of both the PDPL and the CL regarding the matters subject to complaint and ex-officio review, in order to determine the data controller in building complex managements.  

Evaluations

The aforementioned decision firstly defines the concept of data controller. Pursuant to the article 3 of the PDPL, data controller refers to “the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system”.   

The decision states, within the context of the articles 27, 28, 32 and 34 of the CL, that the unit condominium owners board is established to have a say for the whole real estate and that the condominium owners board is the authority determining the content and scope of the management plan which is in the force of a contract binding on the condominium owners, including the manager and that the manager’s duty is to implement those resolutions, within the framework of the resolutions taken by the condominium owners board.  

In its subsequent paragraphs, the decision emphasizes that, pursuant to the article 35 of the CL, the manager’s duties are specified in the management plan, and the fulfilment of the resolutions taken by the condominium owners board constitutes one of the duties assigned to the manager, unless otherwise stipulated in the management plan and that, as per the article 38/1 of the CL, the manager is responsible and liable to the condominium owners exactly as if the manager is the agent of the condominium owners and further that, pursuant the article 40 of the CL, the manager holds, as a rule, the rights held by an agent.  

As regards the subject matter of the review, the provisions of the CL are examined in detail by the decision, in order to determine the data controller in building complex managements.  

Within this framework, after the data controller definition contained in the PDPL and the provisions contained in the CL are evaluated collectively, it is concluded that the condominium owners board is the unit which takes resolutions for the whole real estate subject to condominium ownership and determines how the affairs shall be conducted and that, however,  since the condominium owners board does not have a legal personality, it is seen that the condominium owners board does not bear all the criteria in the data controller definition contained in the article 3 of the PDPL, this is because, given the data controller definition, the title “data controller” may belong to a natural or a legal person.  

The decision also refers to the following Supreme Court judgments regarding the matter that the condominium owners board does not have a legal personality.   

The judgment numbered E. 2004/3091, K. 2004/3556 of 29.03.2004, rendered by the Civil Chamber 1 of the Supreme Court of Appeals:  

 “Natural and legal persons or their legal representatives have the capacity to sue and be sued in the lawsuit. The building condominium owners board (Management) does not have a legal personality and therefore, does not have the capacity to sue and be sued.”

The judgment numbered E. 2007/10090, K. 2007/11914, rendered by the Civil Chamber 1 of the Supreme Court of Appeals:  

“Natural and legal persons or their legal representatives have the capacity to sue and be sued in the lawsuit. The building condominium owners board (Management) does not have a legal personality and therefore, does not have the capacity to sue and be sued.”

However, the decision emphasizes that, even if this is the case, the manager is authorized to receive any notifications related to the whole real estate pursuant to the article 35 of the CL and that the manager who serves as the agent of the condominium owners board may be a real person, or a legal person in case of procurement of professional services from the companies providing services in this field.  

However, in spite of the fact that the resolutions taken by the condominium owners board are binding on the manager and that the manager is obliged to act in compliance with those resolutions; it should also be considered that anomalous circumstances may arise with regard to each concrete case, in the event that the manager or the condominium owners board takes a role determining the purposes and means of processing personal data, responsible for establishment and management of the data filing system. For instance, in the event that the management of a building complex is carried out by a separate legal entity, it should be adopted that such legal entity can also be a data controller at the point of personal data processing.  

In line with all these explanations, the decision states that the “data controller” definition introduced by the Law on the Protection of Personal Data should be interpreted broadly in order to ensure conformity with the ordinary course of life and to resolve the problems emerged in practice.   

Within this context, even though the condominium owners board does not have a legal personality, it is in principle possible to adopt the condominium owners board as a data controller with regard to a building, a building complex or a similar structure, and the condominium owners board may assign a person to fulfill the obligations imposed on the data controller by the Law on the Protection of Personal Data, and such assigned person may either be the manager or another condominium owner or a voluntary representative.  

In brief, considering the fact that exceptional circumstances may also emerge in practice, and in order to determine those who have the capacity of data controller conclusively in the personal data processing activities, it is necessary to determine the units that take resolutions on personal data processing in respect of each concrete case and that establish and manage data filing systems and keep data filing systems under their responsibility.   

Conclusion

In result of the evaluations carried out by the Personal Data Protection Board, it is assessed briefly that:

·     Even though the condominium owners board does not have a legal personality, it is in principle possible to adopt the condominium owners board as a data controller for a building, a building complex or a similar structure,  

·     The condominium owners board may assign a person that shall fulfill the obligations imposed on the data controller by the Law on the Protection of Personal Data,  

·     Such assigned person may either be the manager or another condominium owner or a voluntary representative; however,  

·     Considering the fact that exceptional circumstances may also emerge in practice, and in order to determine those who have the capacity of data controller conclusively in the personal data processing activities, it is necessary to determine the units that take resolutions on personal data processing in respect of each concrete case and that establish and manage data filing systems and keep data filing systems under their responsibility.   

The full text of the decision is accessible at:

https://www.kvkk.gov.tr/Icerik/6798/2020-560