Sharing of Personal Data Obtained via HES Code with Judicial Authorities

Prepared by Kevser Çetin and Berna Ateşoğlu

  1. Introduction

During the Covid-19 pandemic, the Ministry of Health (“Ministry”) developed an application called Hayat Eve Sığar (Life Fits into Home – “HES”) and aimed to monitor the risk by providing a personal code called the HES code through this application. The HES code is a code which provides that the information about whether people are at risk for Covid-19 disease is shared securely with the relevant institutions or individuals. The produced HES codes can be shared with the relevant institutions or individuals directly or via the mobile application.  These institutions or individuals can learn whether there is any risk in terms of Covid-19 questioningly the HES codes which shared with them. For this purpose, individuals are requested to share their HES codes, especially in the use of public transportation and at the entrance to various enterprises and public institutions [1].

Location data such as the places where individuals enter and exit are also processed through contact tracking applications. This essay focuses on terms of HES codes according to 6698 the Law on The Protection of Personal Data as per article 3(1); it addresses the issue whether the Ministry, which has the title of data controller, can share the contact tracking data collected through the HES code with the judicial authorities to be used in the physical follow-up carried out within the scope of any investigation [2]. In this direction, firstly, the concept of physical surveillance in law on criminal procedure will be scrutinized, and then the collection or sharing of contact tracing data for this purpose will be evaluated within the framework of the law in force rules.

  1. Physical Surveillance in Criminal Procedure Law

Criminal Procedure Law No. 5271 as per article 160 and the rest; the public prosecutor, faced with the suspicion of a crime, can do all kinds of research to reach the material fact. Law on Criminal Procedure as per article 160 (2), in order to investigate the material fact and conduct a fair trial, the public prosecutor is obliged to collect and preserve the evidence in favor of and against the suspect, and to protect the rights of the suspect, by means of the judicial police officers under the command of his/her. The public prosecutor may conduct all kinds of investigates directly or through the judicial police officers under his command; may request all kinds of information from all public officials in order to reach the conclusions written in the above article. In this context, the public prosecutor can also request information from state institutions and organizations within the scope of his/her general investigation power.

The surveillance of the suspect without any technical means in order to reach the evidence is also within the scope of this investigative authority and is called “physical surveillance”[3] in the doctrine, and this concept is evaluated within the framework of the principle of public prosecutor’s obligation to investigate, which is included in the Criminal Procedure Law in the provision of article 160 [4]. Although physical surveillance is not a legal term, in practice it is applied by the judicial police in order to follow the suspects in public places and determine the places visited and the people interviewed [5]. In this respect, it would be correct to express that the concept of physical surveillance is not a protection measure qualification and is a method used during evidence collection [6]. Since physical surveillance is not a protection measure, also there is no need for a court decision for its implementation.

  1. Can Tracking Data Be Shared With Judicial Authorities?

As mentioned above, the public prosecutor, who is faced with a suspicion of a crime and will collect the necessary information about the suspect and the evidence in favor and against the suspect, can purview the physical surveillance of a suspect by way of law enforcement officers. As long as this enforcement does not interfere with fundamental rights and freedoms, it will be in accordance with the law.

In this context, firstly, it is useful to make a proportionality assessment due to the Constitution as per Article 13. The principle of proportionality in accordance with the decisions of the Constitutional Court; It includes the elements of convenience, which indicates that the means used for restriction are suitable for realizing the purpose of limitation, necessity, which indicates that the restrictive measure is necessary in order to achieve the purpose of limitation, and proportionality, which indicates that the means and purpose are not in a disproportionate measure, and that the restriction does not impose an undue obligation [7]. In order to clarify the suspicion of crime faced by the investigating authorities, it is possible to say that the suspect’s obtaining evidence by processing the HES coded data meets the convenience factor. However, if it is possible to obtain the personal data to be obtained from the HES code in other ways, the processing of these data by the investigating authorities will violate the necessity element; on the other hand, such a practice would constitute a disproportionate intervention in the private life of individuals. In this respect, it is possible to state that sharing the HES code data with the judicial authorities is a disproportionate intervention in private life.

 If we make an evaluation in terms of the law on the protection of personal data, article 28 of the Law on The Protection of Personal Data brings a regulation regarding exceptional cases where this law will not be applied. Article 28(1)(d) of the Law on The Protection of Personal Data stipulates that the provisions of this law will not be applied if “personal data is processed by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or execution proceedings”. The Law on The Protection of Personal Data provisions will not be applied. According to this article, judicial authorities can process the personal data required for the investigation without being subject to the restrictions in the Law. However, HES codes; These are personal data processed by the Ministry, not by judicial authorities or enforcement authorities. For this reason, the opinion [9] that the tracking data can be shared by the Ministry on the basis of article 28 of the law on the protection of personal data is not appropriate in our opinion.

In the Criminal Procedure Law, procedures that require interference with fundamental rights and freedoms are called “protection measures” and these measures can only be applied on the condition that they have legal basis[8].  Location data obtained with HES codes are also related to the right of privacy.  Obtaining these codes and the tracking data processed through these codes by the judicial authorities in order to carry out physical surveillance without resorting to the relevant protection measures in the Criminal Procedure Law and using them in the investigation will constitute a violation of the principle of legality of crimes and punishments.

  1. CONCLUSION

In the light of current legal regulations, the Ministry, with the title of data controller, collected by way of HES codes and It can process and store tracking data that allows physical tracking of daily activities of individuals. However, the Ministry’s sharing the data regarding the HES code with the judicial authorities, upon the request of the public prosecutor within the scope of the need for a physical surveillance application arising in an existing investigation, would not in accordance with the law in terms of both the principle of proportionality stipulated in the Constitution and the principle of legality of crimes and punishments, which is one of the basic principles of criminal law.

References

[1] Republic of Turkey, Ministry of Health. ‘What is HES Code’, 2020 <https://hayatevesigar.saglik.gov.tr/hes-eng.html> Date of Access: 16.07.2021

[2] Currently, there is no such application officially in Turkey. On the other hand, examples of such practices can be discernible in the world. In Singapore, for example, authorities explained earlier this year that data from the Trace Together program, used for contact tracing, could be used in investigations. Indeed, Parliament passed a bill on 02.02.2021 restricting the use of personal contact tracing data to investigations and prosecutions related to only seven serious crimes, including murder and terrorism. Andreas Illmer, “Singapore reveals Covid privacy data available to police”, BBC News, 05.01.2021, <https://www.bbc.com/news/world-asia-55541001> Date of Access: 16.07.2021; Matthew Mohan, Singapore Police Force can obtain TraceTogether data for criminal investigations: Desmond Tan, Channel News Asia, 04.01.2021, <https://www.channelnewsasia.com/news/singapore/singapore-police-force-can-obtain-tracetogether-data-covid-19-13889914?cid=h3_referral_inarticlelinks_24082018_cna> Date of Access: 16.07.2021; Tang See Kit, Bill restricting use of TraceTogether data for serious crimes passed by Parliament, Channel News Asia, 03.02.2021, <https://www.channelnewsasia.com/news/singapore/bill-restrict-tracetogether-to-serious-crimes-passed-parliament-14096726> Date of Access: 16.07.2021

[3] Serkan Meraklı, “Ceza Muhakemesi Hukukunda Fiziki Takip Kavramının Anlamı ve Bir Koruma Tedbiri Olarak Kanunla Düzenlenmesi Gerekliliği Üzerine Bir İnceleme”, (2020) 15(44) (Ceza Hukuku Dergisi) 865, 911.

[4] Veli Özer Özbek, “Teknik Araçlarla İzleme ve Gizli Soruşturmacı Tedbirleri”, in Türk Ceza Adalet Sisteminin Etkinliğinin Geliştirilmesi (105-180), Avrupa Birliği ve Avrupa Konseyi Ortak Projesi, p. 120. <https://rayp.adalet.gov.tr/resimler/552/dosya/8-teknik-araclarla-izleme-ve-gizli-sorusturmaci-tedbirleri-egitim-modulu25-08-20204-37-pm.pdf> Date of Access: 16.07.2021

[5] Ersan Şen, Teknik Takip – Fiziki Takip, 30 Ocak 2014, <https://www.hukukihaber.net/teknik-takip-fiziki-takip-makale,3346.html> Date of Access: 16.07.2021

[6] see supra note 4-5.

[7] AYM, E.2012/100, K.2013/84, 04.07.2013, § 47.

[8] Bahri Öztürk, Nazari ve Uygulamalı Ceza Muhakemesi Hukuku, (14th, Seçkin 2020) 445-446; Cumhur Şahin and Neslihan Göktürk, Ceza Muhakemesi Hukuku I, (11th, Seçkin 2020) 287-288.

[9] Umut Zorer, ‘Covid-19 Pandemisinde Temas Takip Uygulamaları ve Gözetim Toplumu’, in Yapay Zekâ Çağında Hukuk, Covid-19 Pandemisinde Dijital Dönüşüm ve Hukuk, Özel Rapor (11-29), Mart 2021, p. 25. <https://www.istanbulbarosu.org.tr/files/docs/Covid-19Pandemisinde_Dijital_DonusumveHukuk_OzelRaporu.pdf> Date of Access: 16.07.2021