SORUMLU MU İŞLEYEN Mİ? DAVA ŞARTI OLARAK ARABULUCULUK FAALİYETİNİN KİŞİSEL VERİLERİN KORUNMASI KANUNU BAKIMINDAN DEĞERLENDİRİLMESİ

Under Law No. 6698 on the Protection of Personal Data (KVKKn), individuals who process personal data belonging to natural persons are categorized into two main groups: data controllers and data processors. The rights and obligations concerning the lawful processing of personal data are determined based on the role held by the processor. In the Personal Data Protection Board’s Decision dated 05/07/2018 and numbered 2018/75, as well as in the Public Announcement dated 13.01.2025 on the Fulfillment of the Obligation to Inform Within the Scope of Mediation Activities, mediators have been classified as data controllers under the scope of the KVKKn—regardless of whether they perform mediation on a voluntary or mandatory basis—and it has been stated that they are subject to all obligations imposed on data controllers, with the exception of registration with the Data Controllers’ Registry.However, in mediation processes conducted as a mandatory, the personal data submitted by the applicant via the application form is transferred to the mediator through UYAP (National Judiciary Informatics System) by the mediation office. The mediator processes the obtained data in accordance with the templates provided by the Department of Mediation under the Ministry of Justice and subsequently uploads the documents back to UYAP to conclude the procedure.Given that the mediator does not have independent authority to determine or dispose of the personal data obtained under the Law on Mediation in Civil Disputes and its associated regulations, whether the mediator should be regarded as a data controller remains debatable. In the mandatory mediation process, the primary actor responsible for the collection of data, determination of processing purposes, and operation of the automated system is the Ministry of Justice. This study focuses on determining whether the mediator acts as a data controller or merely as a data processor in the context of mandatory mediation and personal data processing.