Apsiyon
Application For Resident
Pursuant to article 22
of the Turkish Condominium Law, those who take continuous benefit from one of
the independent sections based on rental contract, right of residence, or any
other reason are jointly and severally liable for the expenses and advances and
damages for delay which the homeowner has to pay pursuant to article 20.
Personal Data
Protection Board announced a very topical decision that is of particular
concern for community and site managers.
The case, in which the
community management has informed the jointly and severally liable homeowner
about the debt of the tenant, has been taken to the board as complaint pursuant
to the above mentioned articles of the Turkish Condominium Law.
In the case that was
taken to the Personal Data Protection Board, the tenant had applied to the
community management as the data controller, asking for information as to
whether he has been clarified about the processing of personal data, claiming
that he has received an SMS from the homeowner regarding the payment of dues
and that his personal data has been disclosed by the community management to
the homeowner but he had not given consent to the disclosure of his personal
data to the latter. In response to the said request, the community management
stated that the personal were disclosed upon the request of the homeowner.
Then, the tenant applied to the Board as no explanation regarding the
clarification liability or open consent had been made and asked for an
administrative fine to be imposed on the community management.
The issue was discussed
by the Personal Data Protection Board and reflected upon in the decision no.
2020/755 dated 29/09/2020.
The petition of complaint the tenant submitted to the board is shortly as follows: the tenant received an SMS from the homeowner informing that the monthly dues have been either partially paid or not paid at all; this SMS proved that his personal data was processed illegally as the related person had neither been informed about nor given consent for the disclosure of his personal data by the community management to the homeowner. Accordingly, the tenant exercised his rights stipulated in article 11 of the GDPR by applying to the community management as the data controller and asked for information as to whether he has been made any clarification about the processed/disclosed personal data. The community management stated in return that the monthly due payment information of the related person was disclosed upon request of the homeowner, but no document or proof of legal compliance was available to indicate that a clarification had been given to or open consent had been obtained from the related person. So, a request was placed by the tenant for the imposition of administrative fines upon the community management.
The justification of
the result is laid out in paragraph (2) of article 5 of the Law titled “The
conditions for processing personal data”, which stipulates that “it is possible
to process personal data without seeking for open consent of the related person
in case of the presence of either one of the conditions where data processing
is a must for establishing, using, or protecting a right, or data processing is
a must for the sake of the legitimate interests of the data controller, on the
condition of keeping the basic rights and freedoms of the related person free
from harm". In consideration of the prevalence of the provisions in
article 22 of the Condominium Law and the fact that homeowner and tenant are
jointly and severally liable for common expenses and damages for delay. The
complaint was rejected since no legal
procedures were applicable with regard to the said complaint as it is of
interest for both the homeowner and the community manager when the homeowner is
informed whether the tenant has paid the respective part of the common expenses
of the occupied unit, e.g. monthly dues. Data sharing was done within the frame
of establishing, using, or protecting a right, and the response given by the
community manager to the claims of the related person (tenant) was ruled to be
sufficiently clear.
In conclusion; it was
considered that since the case in which the property management as data
controller disclosed personal data to the homeowner upon the request of the
latter the dues payment status, which is the personal data of the related
person, was judged in the previous decisions of the board in the scope of
establishing, using, or protecting the rights, the property manager is not
expected to obtain further open consent of the related person in relation to
the said data transfer, and that such transfer does not constitute violation of
the Personal Data Protection Law.
We are of the opinion
that a clarification will be made soon as to whether this decision shall form
the basis for the issue of disclosing the debts of flat owners/residents to the
other flat owners or not for the same reason and may be applied by analogy.
You may read the full
text of the decision below.
Decision Date : 29/09/2020
Decision No : 2020/755
Summary : Disclosure of dues payment status of the related person
to the homeowner
The petition of
complaint the related person has submitted to the Board is shortly as follows;
the tenant received an SMS from the homeowner informing that the monthly dues
have been either partially paid or not paid at all; this SMS proved that his
personal data was processed illegally as the related person had neither been
informed about nor given consent for the disclosure of his personal data by the
community management to the homeowner. Accordingly, the tenant exercised his
rights stipulated in article 11 of the GDPR by applying to the community
management as the data controller and asked for information as to whether he
has been made any clarification about the processed/disclosed personal data.
The community management stated in return that the monthly due payment
information of the related person was disclosed upon request of the homeowner,
but no document or proof of legal compliance was available to indicate that a
clarification had been given to or open consent had been obtained from the
related person. So, a request was placed by the tenant for the imposition of
administrative fines upon the community management.
As a result of the
examination of the issue, the Personal Data Protection Board has reached the
Decision no. 2020/755 dated 29/09/2020, which is as follows;
Paragraph (1) in
article 5 of the Law titled “Conditions for processing personal data”
stipulates that personal data may not be processed without the open consent of
the related person, and paragraph (2) stipulates that processing of personal
data without open consent of the related person is possible in cases where
processing the personal data of the parties to a contract is a necessity as
clearly set forth by laws, is compulsory for protecting the life or the
physical integrity of a person who is unable to express his consent for actual
impracticability or whose consent is legally invalid or of another person, or
is directly related to the execution or performance of a contract; where such
processing is necessary for the data controller to fulfil its legal
liabilities; where such information has already been publicized by the related
person; where data processing is necessary for establishing, using or
protecting a right; and where data processing is necessary for the legitimate
interests of the data controller on the condition of keeping the basic rights
and freedoms of the related person free from harm,
On the other hand,
article 22 of the Condominium Law no 634 titled “Warranty of Shared Expenses”
includes the provision which stipulates that, “The people, who are users of the
apartment either by residence rights or by means of the rental of that
particular apartment or by other means, have mutual and solidary obligation upon
the expenses on their share, with reference to Article 20 of the law.
Nevertheless, the tenant(s)’ liability is limited to the rent that he has to
pay. For this reason the extra payment that he makes is to be reduced from the
amount of rent he has to pay".
Considering the fact
that the tenant and the homeowner are jointly and severally liable for common
expenses and damages for delay pursuant to the above legal provision, it is for
the interests of both the homeowner and the community manager when the homeowner
is informed about whether the tenant has paid the respective parts of the
common expenses of the related flat, such as monthly dues, and therefore such
data processing is done within the scope of establishing, using or protecting a
right pursuant to item (e) in paragraph (2) of article 5 of the Law no 6698,
In this respect,
considering that the data controller has replied the related person stating
that the debt information of the related person has been disclosed to the
homeowner upon the request of the same, such response given by the data
controller to the related person is ruled to provide sufficient clarification
for the claims of the related person
and therefore;
Based on the fact that
the dues payment status, which is, in nature, personal data of the related
person, has been disclosed by the data controller upon request of the homeowner
and that such disclosure has been made pursuant to the provisions in article 22
of the Condominium Law no 634; it has been decided that the explanations included
in the response letter that the data controller, community manager, has sent to
the related person are aimed at clarifying the issues that are claimed by the
related person and therefore no legal procedures are applicable with regard to
the said complaint.
29 February 2024