How to Protect Social Media Accounts?

A. Introduction

Social media has become an indispensable digital platform that increases the daily visibility of individuals and institutions, enabling them to carry out communication and marketing activities. Social media accounts are created for various purposes, including personal use, commercial accounts (e.g., influencer accounts), and corporate accounts. Consequently, depending on their type and purpose, these accounts and the content shared on them may, at times, contain personal data, commercial data, advertising/marketing materials, and even works of intellectual and artistic property, as well as registered trademarks.

However, accounts, posts, and content created on these platforms can be subjected to unlawful interference; unauthorized use or copying of content, and account takeovers are violations that lead to legal proceedings. This article will discuss how social media accounts are protected under Turkish law, addressing it from the perspectives of personal data protection law, law of obligations, intellectual property law, industrial property law, criminal law, and information technology law.

B. Legal Avenues for the Protection of Social Media Accounts

1. Protection of Personality Rights

The fundamental provisions concerning the protection of personality rights are set out in Articles 23-25 of the Turkish Civil Code No. 4721 (“Law No. 4721“) and Article 58 of the Turkish Code of Obligations No. 6098 (“TCO”).

The relevant articles of the Law No. 4721 stipulate that individuals cannot waive their capacity to hold rights and act, nor their fundamental rights and freedoms, through any legal transaction, and cannot restrict them in any way. They also provide that individuals can seek protection against unlawful acts of third parties that constitute an infringement of their personality rights. In cases of infringement of personality rights, three different types of lawsuits can be filed: (i) cessation of the infringement, (ii) prevention of the infringement, or (iii) determination of the infringement.

Furthermore, it is also possible to claim pecuniary and non-pecuniary damages by filing a compensation lawsuit. At this point, it should be noted that the judge may decide on another form of compensation instead of or in addition to this compensation; specifically, the judge may issue a decision condemning the infringement and rule on its publication. In the event that a gain has been obtained as a result of the infringement, the restitution of this gain can also be subject to the lawsuit based on the provisions regarding management of affairs without mandate (negotiorum gestio).

2. Protection of Personal Data

Content shared on social media accounts often constitutes personal data, and such data is protected under the Personal Data Protection Law No. 6698 (“PDPL“). Social media platforms process users’ personal data (e.g., name, email address, IP information, etc.) and use it for specific purposes. Especially in the processing of such data, platforms are considered data controllers under the PDPL and are therefore obligated to prevent the unlawful processing and access to this data.

In situations where data shared by users when creating or using their accounts is used/shared beyond the purpose of sharing, in other words, without the consent of the data subject, or when unauthorized access to this data or directly to the user account is obtained by others (e.g., hacking) due to the platform’s failure to take adequate administrative and technical measures, data subjects can directly apply to the platform, which holds the title of data controller. If this application remains unanswered/unsuccessful, they can resort to complaint procedures with the Personal Data Protection Authority.

However, it should be reminded that as a result of the complaint procedure, the decisions made by the Personal Data Protection Board will not result in the data subject being financially compensated. Instead, the application will conclude with the Personal Data Protection Board imposing an administrative fine on the relevant data controller and/or obligating the data controller to cease data processing activities, delete/destroy/anonymize personal data, or take specific measures within a certain period.

Pursuant to Article 14(3) of the PDPL, the right of those whose personality rights have been infringed to claim compensation under general provisions is reserved. A person who has suffered pecuniary or non-pecuniary damage due to the unlawful processing of their personal data retains the right to file a separate compensation lawsuit in general courts to seek compensation for their damages.

3. Protection Under Intellectual and Artistic Works Law

Under the Law on Intellectual and Artistic Works No. 5846 (“LIAW“), the definition of “work” encompasses all kinds of intellectual and artistic products, including scientific, literary, musical, fine arts, and cinematographic works, that bear the peculiar characteristics of their author. When determining whether a content is subject to copyright, the distinctiveness of the work, its aesthetic value, similarities, and the distinction between inspiration/copying are taken into account. Content shared on social media, such as texts, photographs, visuals, and videos, can be classified as a “work” under the LIAW.

Indeed, in the digital age, the concept of “work” extends beyond the traditional definitions of the LIAW. While the LIAW traditionally emphasizes the “peculiar characteristics” of the work and its inclusion in specific categories (science, literature, fine arts, cinema), social media content is often produced in short formats and sometimes collectively produced by different individuals. Therefore, today, the concept of “work” needs to be interpreted more broadly and inclusively to cover new forms of digital expression.

A wide range of social media content, from a uniquely stylized photograph or video to a well-structured blog post or a distinctive digital artwork, can legally be defined as a “work.” Consequently, the unauthorized use, sharing, or modification of such content can trigger liability under the LIAW.

When the pecuniary and moral rights of the author are infringed, there are legal remedies available. Articles 66-72 of the LIAW grant the author the right to file lawsuits such as compensation, cessation of infringement, prevention of infringement, or determination of infringement.

Article 68 of the LIAW grants the author the right to claim a special type of compensation in case of pecuniary right infringements. Accordingly, those who unlawfully reproduce, disseminate, perform, or communicate to the public may be requested to pay compensation of up to three times the amount that would have been demanded if a contract had been concluded, or the determined fair market value. This method stands out as an important strategic alternative, especially given the rapid dissemination of content in digital environments like social media and the difficulty of completely physically removing it.

In cases of infringement of pecuniary and non-pecuniary rights, compensation may also be claimed. The infringed party may also demand that the profit obtained be given to them. However, in this case, the amount demanded under Article 68 shall be reduced.

Article 71 of the LIAW regulates the classification of infringements of authors’ pecuniary, non-pecuniary and related rights as crimes and subjects them to criminal sanctions. Persons committing the acts specified under this article may also be sentenced to imprisonment or judicial fines.

4. Protection Under the Industrial Property Law

Trademark rights are protected by the Industrial Property Law No. 6769 (“IPL“). If commercial social media account names represent the enterprise’s trade name or brand name, they can be protected by trademark registration. The use of a trademark without the owner’s permission in a way that causes confusion in the trade area and among consumers is considered trademark infringement. Trademark infringement can also occur in the social media environment. Trademark registration provides a strong legal shield against the imitation of commercial social media accounts.

A registered trademark grants exclusive rights to the trademark owner and facilitates the direct application of criminal and legal remedies under the IPL in case of infringement. These remedies include types of lawsuits that the trademark owner can file, such as determination of infringement, cessation, and prevention of infringement. The trademark owner can also claim compensation for pecuniary and non-pecuniary damages suffered due to the infringement. Article 30 of the IPL regulates trademark infringement crimes and the criminal sanctions to be applied to them. Therefore, trademark infringements not only give rise to liability for damages at the private law level but can also be subject to criminal law sanctions. Therefore, trademark rights have multifaceted legal protection.

Unregistered trademarks, on the other hand, can be protected under the unfair competition provisions of the Turkish Commercial Code No. 6102. This method of protection is explained under the heading “7. Protection Under the Turkish Commercial Code.”

5. Protection Under Criminal Law

Unlawful interferences targeting social media accounts can constitute various cybercrimes and other related offenses under the Turkish Penal Code No. 5237 (“TPC“). These crimes can be directly aimed at information systems, or they can be other crimes committed using information systems.

For instance, unauthorized access to a person’s social media account or email address may constitute the crime of “entering an information system” under Article 243 of the TPC. Indeed, the crime is committed by the act of “unlawful entry”; no further damage or other consequences are required.

Actions such as unauthorized access to a social media account and changing the password to prevent access may be considered the crime of “blocking, disrupting, destroying, or altering a system data” under Article 244 of the TPC.

Furthermore, Article 136 of the TPC also provides for criminal sanctions for acts of unlawfully giving, disseminating, or seizing personal data to another person. This crime constitutes the criminal law dimension of personal data protection law. In the context of social media, disseminating someone else’s personal data by opening a fake account or seizing a private account and disseminating the information contained therein may fall within the scope of this crime.

Moreover, in some cases, if the content and nature of an image or audio recording are examined in detail and it is determined that the recording pertains to a person’s “private sphere of life,” the infringement may also fall within the scope of the crime of violating the privacy of private life under Article 134 of the TPC. Situations such as sharing seized social media messages may constitute a crime within the scope of violating the privacy of communication under Article 132 of the TPC.

If the actions constitute a crime, those who committed the actions will be subject to imprisonment and judicial fines, which are deterrent in nature for the person committing the infringement.

Cybercrimes and crimes against private life and the secret sphere of life must be investigated ex officio by the prosecution. In other words, the crime is not subject to complaint. However, in practice, these crimes are usually learned by the Public Prosecutor upon the notification of the victims. Therefore, in such a situation, it is important to make a notification to the Public Prosecutor’s Office or law enforcement authorities.

6. Protection Under Information Technology Law

The obligations and responsibilities of content providers, hosting providers, access providers, social network providers, and mass usage providers, as well as the principles and procedures for combating certain crimes committed in the internet environment, are regulated by the Law No. 5651 on the Regulation of Publications Made on the Internet and the Fight Against Crimes Committed Through These Publications (“Law No. 5651”).

Pursuant to the relevant law, individuals who claim that their privacy of private life has been violated due to the content of publications made on the internet can directly apply to the Information and Communication Technologies Authority (“ICT”) with the necessary information and documents to request the implementation of the access blocking measure.

If there are no procedural deficiencies in the request, the request is fulfilled within a maximum of 24 hours. Individuals requesting access blocking must submit their request to the court within 24 hours from the time of the ICT applicaiton. The judge evaluates whether the privacy of private life has been violated and announces their decision within a maximum of 48 hours, sending it directly to the ICT; otherwise, the access blocking measure will automatically be lifted.

Furthermore, the relevant law imposes various obligations, especially on social network providers with more than 1 million daily accesses from abroad and in Turkey, regarding the appointment of a representative, notification to the ICT, and content management. Failure to comply with these obligations can lead to the ICT requesting bandwidth throttling sanctions and imposing significant administrative fines.

One of the most important dimensions of these regulations is the direct application right granted to individuals. Social network providers with more than 1 million daily accesses from Turkey are obliged to respond to content removal or access blocking requests from individuals within a maximum of 48 hours, under the “Board Decision on Procedures and Principles Regarding Social Network Providers” issued pursuant to Additional Article 4 of Law No. 5651. These regulations detail the legal responsibilities of internet publication content while offering mechanisms that provide quick results to individuals in cases of privacy violations.

7. Protection Under the Turkish Commercial Code

Today, commercial social media accounts have ceased to be merely communication tools for businesses and have become digital commercial assets reflecting the brand’s reputation and economic value. In this context, it is crucial to re-evaluate the legal status of these accounts under existing legislation and to assess them in accordance with evolving needs.

Situations such as the takeover of commercial social media accounts, their unjustified blocking, imitation by misleading/fake accounts, or domain name/ad manipulations have the potential to cause serious material and moral losses for businesses. These types of actions may constitute unfair competition under the Turkish Commercial Code No. 6102 (“TCC“). Indeed, under the TCC, “unfair competition” is defined as deceptive or otherwise dishonest conduct and commercial practices affecting relationships between competitors or between suppliers and customers.

In such a case, those whose customers, credit, professional reputation, commercial activities, or other economic interests have been harmed or are at risk of being harmed may demand the determination of whether the act is unfair, the prohibition of unfair competition, the elimination of the material situation resulting from unfair competition, the correction of false or misleading statements if unfair competition was conducted with such statements, compensation for damage and loss if there is fault, or non-pecuniary compensation if the conditions stipulated in Article 58 of the TCO are present.

It is important to emphasize at this point that since unfair competition provisions will only apply to merchants, the perpetrators of this crime are merchants. Legal entities such as commercial companies, associations, and foundations are also considered merchants if they operate a commercial enterprise. Commercial companies may also be subject to unfair competition provisions if they commit such infringements through social media platforms.

Additionally, Article 62 of the TCC regulates unfair competition crimes and their sanctions. The investigation of the crime is subject to complaint. Upon the complaint of one of those entitled to file a civil lawsuit, there is a possibility that the infringers may be sentenced to imprisonment or a judicial fine for the said acts. If the act of unfair competition is committed within the scope of a legal entity’s activities, specific security measures pertaining to legal entities may be decided upon regarding the legal entity.

C. Conclusion and Evaluations

In cases of social media account infringement, multiple avenues of protection are available under Turkish law. By resorting to legal avenues in various fields, from the protection of personality rights to criminal law, from the law of obligations to intellectual property rights, it becomes possible to protect accounts, compensate for damages, and held those who commit infringements liable or at least to deter them. These different disciplines assume independent and complementary roles in the protection of digital assets.

Therefore, the protection of social media accounts is a dynamic field requiring a multi-disciplinary approach and should be addressed with a multi-layered strategy. The effective use of legal mechanisms in this area is critical with the developing technology and increasing social media usage. It is of great importance for individuals and institutions to thoroughly understand the existing legal avenues to effectively protect their digital assets.

In practice, the detection, substantiation, demonstration of damage, and proof of causal link of such infringements present significant challenges, given the inherently fragile and easily manipulated nature of digital evidence. Although the legal system attempts to combat crimes in this area through the various regulations mentioned above, the complexity of legal processes and the need for technical knowledge impose additional burdens on the aggrieved party.

To overcome these difficulties and increase the chances of success in the legal process, victims are strongly advised to take proactive and strategic steps before initiating legal proceedings. If possible, it is highly important to take screenshots and video recordings of all relevant digital content (messages, posts, profiles) as soon as the action is noticed, to record URLs/date/time information, to obtain a notarized detection report through the Turkish Notaries Union’s E-Detection service, to seek support from a forensic IT expert, to immediately notify the social media platform or other digital service provider (email, bank, etc.) where the action took place, and to receive professional legal assistance from the very beginning of the process.