Photography and publication: personal data and criminal liability under Turkish law

Photographs and video recordings qualify as personal data in the form of “visual and audio records” under the KVKK. Acts such as sharing a person’s photograph on social media, using it in company magazines, publishing it on a website or displaying it in the workplace all constitute “data processing” activities within the meaning of the KVKK. As a rule, pursuant to Article 5/1 of the KVKK, personal data may not be processed without the explicit consent of the data subject. Although Article 5/2 provides for certain exceptional legal grounds for processing, the use of photographs will, in most cases, not fall within these exceptions and explicit consent must be requested for such use.

Accordingly, to use a person’s photograph in areas such as campaigns, catalogues, social media posts or in internal and external company publications, explicit consent within the meaning of the KVKK is required. Such consent is expected to relate to a specific purpose, to be based on information provided to the data subject as to why and where the photograph will be used and must be given freely. In other words, broad and vague statements such as “I consent to any and all uses” are not considered safe from a KVKK perspective; consent should be limited by a concrete purpose to the greatest extent possible.

A decision rendered by the 12th Criminal Chamber of the Court of Cassation provides a clear example of the criminal law dimension of the use of photographs. In the mentioned case, the data subject had wedding photographs taken at a photo studio. The studio owner later began showing these photographs to other customers visiting the studio as samples, without obtaining any permission from the data subject. The Court of First Instance initially assessed the incident under the offence of “violation of privacy” and acquitted the defendant. When the data subject appealed the decision of the Court of First Instance, the Court of Cassation reversed the decision, ruled that displaying the photographs in this manner constituted the offence of “unlawfully giving or acquiring personal data” and sentenced the defendant to one year and eight months' imprisonment.

The point here is that the photographs were originally taken in a lawful manner. However, this lawfulness only covered the taking and delivery of photographs. Any subsequent use of photographs for promotion or advertising is a new and different data processing activity. Since no separate and explicit consent had been obtained for this new purpose, the Court of Cassation considered the use to be unlawful under both the KVKK and the TCC.

On this subject, the Data Protection Board (“Board”) has already issued guiding decisions and has made it clear that explicit consent is not the only possible legal basis for processing photo and video data; in some cases, other legal grounds such as the conclusion or performance of a contract or the data controller’s legal obligations may also apply. Among the cases examined by the Board is a situation where the photographs of a data subject working as a catalogue model for a clothing store continued to be published on the data controller’s website even after the employment relationship had ended, until the relevant products were sold out. The Board assessed this processing as “processing of personal data directly related to the performance of a contract” within the meaning of Article 5/2(c) KVKK. In that case, the model’s work already consisted of participating in catalogue shootings and having these photographs used for product promotion, and the processing was therefore considered to be in line with the contractual framework. For this reason, the Board did not impose any sanction on the data controller.

In conclusion, under Turkish law, taking photographs and publishing them does not only give rise to the risk of administrative fines under the KVKK; it may also lead to criminal consequences, including imprisonment, under the TCC. For companies that use photographs and video recordings taken in Türkiye and relating to individuals in Türkiye, but operate or communicate internationally, it is therefore essential to ensure that such visual material is processed in compliance with both the KVKK and the TCC and that contractual clauses, information notices and explicit consent mechanisms are designed accordingly.