An airline company
- Country
- Turkey
- Fine
- 100,000 TRY
- Date
- 2019-10-01
- Sector
- Private Sector
- Articles
- Article 4,6,12 and 18 of the DPL
Failure to comply with duties related to ensuring information security + Insufficient legal basis for sensitive data processing
It has been determined by the KVKK that an airline company had processed sensitive personal data by taking a copy of national ID (which includes the blood type and religion information) and therefore decided to issue a penalty based on the lack of legal basis of such processing activity. The KVKK also ordered to stop the processing and destroy or anonymyse the data. Authority: Turkish Data Protection Authority (KVKK)
Source: https://www.kvkk.gov.tr/Icerik/6556/2019-294
Reported by: Mehmet Gün