Personal Data Shared in Municipal Services: Breaches in the Name of Transparency

⏱️ Reading time: 11 min · 📁 Category: KVKK, Transparency & Public Institutions

Personal Data Shared in Municipal Services: Breaches in the Name of Transparency

Municipal transparency is essential for informing the public, ensuring accountability and
enabling public resources to be audited.
In practice, however, “transparency” can become
a justification for disproportionate, uncontrolled disclosure of personal data
in municipal operations.

Decisions of the Turkish Personal Data Protection Board and audit practices show that
one major category of municipal breaches involves
data disclosure through tender documents, municipal council decisions and public notices
published by municipalities.
This article provides a systematic framework for identifying where mistakes occur.

Basic principle:
Transparency does not mean unlimited sharing of personal data. Legal Balance Between Transparency and KVKK

Municipalities have transparency obligations under Municipal Law No. 5393, Public Financial Management and Control Law No. 5018
and other relevant legislation.
However, this obligation does not override the following KVKK principles:

• Data minimisation
• Purpose limitation
• Proportionality
• Confidentiality

These principles continue to apply.
Under the Board’s established approach,
personal data must be redacted even from documents that must be made public.

The most common breaches arising from “transparency” 1) Publishing unnecessary personal data in tender documents

Tender procedures are among the municipal activities with the most data disclosures.
Tender notices, specifications and material shared outside EKAP often publicly expose:

• Turkish national identification numbers
• Address and contact information
• Signature circulars and copies of identity documents

Examples of such public disclosures are common.
Yet transparency in tendering
does not require personal data to be shared without masking.

Tender transparency = process information
≠ disclosure of all personal data 2) Failing to redact personal data from municipal council decisions

Municipal council decisions are often published as PDF or text
on the municipality’s website.
These decisions may include:

• Citizens’ names
• Complaint details
• Information about social assistance and personal circumstances

Such information may be shared without any masking.
Under the KVKK, this constitutes
an explicit and direct disclosure of personal data by the municipality.

3) Excessive information in statutory public notices and announcements

Notices concerning zoning plans, permit procedures and statutory public displays
are among the most frequent sources of KVKK breaches.

• Full identity details of plot owners
• Address and contact details
• Unnecessary explanatory personal notes

According to the Board’s practice,
statutory public notices must disclose only the minimum information necessary.

4) Old Documents Archived on Municipal Websites

Old tender files, municipal council decisions and notices
kept accessible for years under an “Archive” heading
leave personal data publicly accessible
even when there is no longer a current purpose.

A document whose retention period has expired
must not remain publicly accessible. 5) Data disclosure in press releases and social media posts

Municipal press releases and social media posts often include:

• Images of people receiving social assistance
• First and last names
• Statements exposing personal situations

Such disclosures are common.
The justification of “informing the public”
does not automatically make these disclosures lawful.

Why do these breaches keep recurring?

• Misinterpretation of the concept of transparency
• Lack of KVKK control mechanism prior to document publication
• Lack of coordination between legal and press/communications teams
• Lack of knowledge about masking and anonymisation

Most transparency-related breaches
result from a lack of control rather than malicious intent. What should municipalities do? Practical measures

• Establish a KVKK pre-publication check for public documents
• Set masking and anonymisation standards for tender documents and council decisions
• Minimise personal data in statutory public notices
• Website archives should be periodically reviewed
• Provide press and communications teams with specific KVKK training

Conclusion

Municipal transparency
does not conflict with the KVKK;
when properly applied, the two work in harmony.
The real risk is to interpret transparency as "exposing everything".

Disproportionate sharing of personal data
creates not only a risk of administrative fines,
but also undermines trust in the institution.

Transparency & KVKK Risk Analysis