Assessment of The Personal Data Protectıon Board's Decision on A Data Breach Committed by an Airline Company

Today, the increase in technological developments has led to both the inclusion of information in various fields within the scope of personal data and the expansion of the scope of processing of personal data accordingly. In order to protect personal data and prevent violations, a legal basis has been tried to be established in both national and international legislation. While the legislation aims to protect the right to privacy, it also aims to regulate and supervise data processing activities and to prevent violations of the law. The Personal Data Protection Board is an independent authority that serves this purpose by supervising the lawful activities of data controllers. In its decision dated 03.08.2023 and numbered 2023/1309, the Board evaluated the complaint regarding the data breach of an airline company. The incident concerned a passenger's ability to view the identity and travel documents of other persons. The fact that the data of the data subjects was accessible by third parties shows that technical and administrative measures were not taken. The decision on this case, which demonstrates the importance of the legal obligations of data controllers and that violations can lead to serious sanctions, is very important in terms of improving data protection mechanisms and protecting the rights of individuals.