23.06.2026 14:00
The Personal Data Protection Authority (KVKK) has made a notable decision regarding live broadcasts by municipalities for tourism and promotion purposes. Stating that broadcasts where faces and vehicle plates are identifiable may constitute a personal data violation, the authority called for the cessation of such broadcasts and announced that sanctions may be imposed on municipalities that do not comply with the rules.
In a statement from the Personal Data Protection Authority (KVKK), it was stated that many reports and complaints were received regarding municipalities installing cameras in busy or touristic areas such as streets, squares, parks, and coasts for touristic promotion purposes, and broadcasting the footage live on their websites for anyone to view.
"IMAGES CONTRARY TO KVKK"
In the decision, where it was stated that due to the determination that this practice is widespread across the country, there was a need to inform the public to ensure personal data security and prevent rights violations, the following was noted:
"In the investigations conducted by the Personal Data Protection Board, it was determined that due to the angles of cameras positioned by municipalities for touristic promotion, the faces of real persons are visible and vehicle license plates are readable. Considering that this data constitutes personal data, monitoring via cameras, even if not recorded, and broadcasting live over the internet makes personal data accessible, thus it is considered a personal data processing activity under Law No. 6698 on the Protection of Personal Data. Therefore, municipalities, as data controllers, are obliged to take all necessary technical and administrative measures to prevent the unlawful processing of personal data and unauthorized access to such data in accordance with the law."
In the statement, where it was reminded that the law determines the conditions for processing personal data, it was conveyed that the first paragraph of the relevant article stipulates that "personal data cannot be processed without the explicit consent of the data subject," while the second paragraph sets forth the conditions under which personal data can be processed without seeking explicit consent.
PENALTIES FOR THOSE NOT COMPLYING WITH THE DECISION
In the statement, where it was recalled that Municipal Law No. 5393, regulating the duties and responsibilities of municipalities, authorizes municipalities to provide cultural and artistic, tourism, and promotion services, provided they are of a local common nature, the following expressions were used: "However, this provision does not include an explicit legal obligation for municipalities to conduct live monitoring directly with cameras for touristic promotion purposes. Additionally, such broadcasts cannot be considered within the scope of monitoring carried out by authorized public authorities to ensure the security of public spaces."
In the statement, where it was indicated that monitoring individuals with cameras in areas such as squares, walkways, seating areas, and beaches, where they socialize, relax, and spend time, constitutes an interference with the right to respect for private life, attention was drawn to the fact that due to the instant online publication of the images, an unlimited number of people can access them, making it possible for third parties to record, transfer, and use them for non-touristic and malicious purposes such as theft, threats, blackmail, and violence.
In the statement, where it was noted that this carries a risk of causing irreparable harm to the relevant individuals, the following was recorded:
"Within this scope, it is respectfully announced to the public that municipalities must urgently cease their current live broadcast activities carried out for tourism and promotion purposes, which lead to the identification of real persons and are not based on any legal grounds under Law No. 6698, and that necessary measures must be taken to provide these live broadcast activities through alternative means that do not involve the processing of personal data of the relevant individuals. Furthermore, administrative sanctions may be imposed on data controller municipalities found not to comply with the necessary measures for personal data security and the decisions of the Board."