The Court of Justice of the European Union (CJEU), in its judgment dated March 19, 2026 in Case C-526/24 (Brillen Rottler) ("Decision"), has established an important precedent regarding the limits of data subject rights under the GDPR. The Decision clarifies under which conditions the right of access under Article 15 GDPR may be restricted within the framework of Article 12(5) GDPR, while also reassessing the scope of the right to compensation under Article 82 GDPR.

QR code technology has become one of the key tools of the digital economy. From restaurant menus to public services, from e-commerce to financial transactions, QR codes are used across a wide range of contexts and—because they are fast and practical—have become a natural part of user behaviour. However, this widespread adoption also creates an exploitation ground with a low level of suspicion from the attacker’s perspective.

In its Information Note dated 26 February 2026 titled “The Risk Coming with QR Codes: Quishing” (“Information Note”), the Turkish Data Protection Authority (“KVKK”) examines phishing attacks carried out via QR codes in detail and assesses this threat from a personal data security perspective. The Information Note clearly demonstrates that the issue is not merely a technical cybersecurity risk; it is also an area that must be addressed directly within the scope of data protection law.

With the Decision of the Personal Data Protection Board published in the Official Gazette dated October 1, 2025 and numbered 33034, amendments have been made to the exemption criteria regarding the obligation to register with VERBİS (Data Controllers' Registry Information System), which is carried out pursuant to Article 16 of the Law on the Protection of Personal Data No. 6698.