KVKK issues ruling on ID and photo requirements for crypto accounts

The Personal Data Protection Authority (KVKK) has ruled that the processing of members' identity and photograph information by crypto asset service providers falls within the scope of their obligations under the Law on the Prevention of Laundering Proceeds of Crime.

According to the KVKK's decision, an individual who became a member of a crypto asset service provider requested an increase in their membership level on the platform. The service provider, acting as the data controller, requested a photograph of the front and back of the individual's ID card as well as a passport-style photo.

The individual applied to the KVKK, arguing that the data controller was processing personal data excessively and disproportionately, and requested an investigation under the Personal Data Protection Law No. 6698 and the deletion of the processed information.

The KVKK pointed out that crypto asset service provider data controllers have obligations under the Law on the Prevention of Laundering Proceeds of Crime No. 5549 regarding the processing of personal data, and ruled that the data processing was appropriate.

In its decision, the Board stated that the data controller may request personal data to identify and verify that the transactions were performed by the user, and ruled that the processing of the requested personal data is based on the legal processing condition set forth in the Personal Data Protection Law No. 6698.

The Board determined that there was no action to be taken, noting that the applicant's request for the deletion of their personal data should first be directed to the data controller.