The rapid development of artificial intelligence (“AI”) systems, diversification of focus areas, and the increasing number of users have introduced potential harms related to privacy, ethics, security, and fundamental rights. In response to the need to mitigate these potential harms and prevent possible violations, the Council of the European Union approved the Artificial Intelligence Act (“AI Act”) on May 21, 2024, which has been under preparation since April 21, 2021, as a framework law¹.

Law No. 6698 on the Personal Data Protection ("Law") stipulates its purpose in Article 1 titled "Purpose" as follows: “The purpose of this Law is to protect fundamental rights and freedoms of persons, particularly the right to privacy, with respect to processing of personal data and to set forth obligations, principles and procedures which shall be binding upon natural or legal persons who process personal data.” This provision regulates how personal data will be processed. Personal data is defined as "any information relating to an identified or identifiable natural person" in subparagraph d of Article 3 of the Law. Personal data are divided into special and general categories. In Article 6 of the Law titled "Conditions for processing of Special categories of personal data", special categories of personal data are defined as follows: "Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data are deemed to be special categories of personal data."

Personal Data is any data relating to an identified or identifiable natural person. The Personal Data Protection Law (KVKK) defines "personal data" as follows. KVKK, which entered into force in 2016 and is a law that can be said to be young, makes many regulations in this regard. Issues such as personal data and processing of personal data are stipulated in this law. The purpose of the KVKK is stated in the first article as "The purpose of this Law is to protect fundamental rights and freedoms of persons, particularly the right to privacy, with respect to processing of personal data and to set forth obligations, principles and procedures which shall be binding upon natural or legal persons who process personal data." With the regulations made in line with this purpose, KVKK has also examined the processing of personal data by grouping them. While the conditions for the processing of personal data are analysed in Article 5, the " Conditions for processing of Special categories of personal data" are included in Article 6. Biometric data is also mentioned in this article. For this reason, it should be said that biometric data are special categories of personal data.