KVKK’DA İSTİSNALAR VE İLKELERİN DENGELENMESİ: KRİTİK BİR ANALİZ

The purpose of the Law on the Protection of Personal Data No. 6698 (KVKK) is to protect individuals' fundamental rights and freedoms during the processing of personal data and to define the obligations of data controllers. The fundamental principles outlined by the law, ensuring the lawful processing of personal data, play a critical role in data processing activities. However, Article 28 of the law introduces certain exceptions, particularly concerning public and economic security, providing exemptions in specific cases. In practice, ensuring that these exceptions align with the general principles of the law is considered a legal necessity.This article examines how the exceptions outlined in Article 28 of KVKK should be balanced with the law’s general principles. The practical challenges of applying these exceptions, especially in data processing activities related to public and economic security, are evaluated through concrete examples involving institutions such as the General Directorate of Security (EGM) and the Financial Crimes Investigation Board (MASAK). Additionally, a comparative analysis is conducted with the General Data Protection Regulation (GDPR) of the European Union and U.S. laws such as the California Consumer Privacy Act (CCPA), highlighting KVKK’s alignment with international data protection standards. Despite aligning with global standards, Turkey's KVKK struggles with practical challenges in applying exception provisions, especially in balancing privacy with public securityLastly, recommendations are provided for strengthening oversight mechanisms, increasing transparency in data processing, and ensuring better protection of personal data.