Massive data breach in Turkey: Veysel Ok files lawsuit against Turkey's Ministry of Interior

BARIŞ ALTINTAŞ*

Co-Director of the Media and Law Studies Association (MLSA), Veysel Ok, has lodged a criminal complaint and a lawsuit seeking damages against officials from the Ministry of Interior. The legal action follows the unauthorized sale of personal data belonging to Turkish residents, which appears to have been leaked from the databases of state-owned institutions, and subsequently offered for sale on various online platforms. In his criminal complaint, Ok alleges that the Ministry of Interior, along with the proprietors of the implicated websites, violated the right to privacy and are guilty of the "unlawful acquisition and dissemination of personal data." The data in question appeared for sale on a website called "Sorgu Paneli" last week. Ok further alleges that Ministry officials either "abused their duty" or "neglected their duty." In addition to the criminal charges, a lawsuit was filed seeking 50,000 TL ($5,740) in damages. The legal filing argues that the Ministry of Interior has an objective responsibility, or "strict liability", for protecting data stored within databases held by state institutions of the Republic of Turkey. This concept of strict liability implies that the Ministry of Interior is accountable regardless of any potential negligence or misconduct. The suit maintains that the Ministry must shoulder the blame for jeopardizing and sharing the personal data stored within various state databases, which it is entrusted to safeguard. Commenting on the lawsuit, Ok stated, "We also expect to receive information about how this data was obtained during these litigation processes. We believe that through these proceedings, the mechanisms enabling data theft, leakage, and sharing will be better understood." Ok added that any individual whose information was contained within the compromised database could similarly file a lawsuit. The data leak first came to light on June 3, when personal information belonging to millions of Turkish citizens and foreign residents was found on the "Sorgu Paneli" website and its associated social media platforms. The available information includes a data set from the 2022 Public Health Management System, election data from 2009 and 2015, a data set containing 116 million GSM (mobile phone) numbers, and polling data for 2023. Other personal details, such as Turkish ID numbers, names, phone numbers, and residential addresses, were also included. It was established that the website's operators did not themselves extract the data, which was available for purchase or sharing on an indeterminate number of additional sites and platforms.