Content removal and data protection law, article by article

The articles of Turkish law, the GDPR, the Digital Services Act, the DMCA and German and UK law that matter for content removal: what they say and how they are used. General information, not legal advice.

Digital Services Act Article 16: notice and actionArticle 16 DSA requires hosting services in the EU to offer an easy mechanism for reporting illegal content.
Digital Services Act Articles 17, 20 and 21: reasons, appeals and dispute settlementThe DSA gives users three safeguards against platform decisions: a statement of reasons (17), an internal complaint system (20) and an independent dispute settlement body (21).
DMCA Section 512: safe harbour, takedown and counter noticeDMCA 512 shields platforms from copyright liability for user content, provided they remove content promptly when they receive a valid notice.
ECHR Articles 8 and 10: privacy versus expressionArticle 8 of the European Convention on Human Rights protects private life and Article 10 freedom of expression; most removal disputes are about balancing the two.
EU AI Act Article 50: labelling deepfakesArticle 50 of the EU AI Act requires AI-generated or manipulated images, audio and video (deepfakes) to be disclosed as such; it applies from 2 August 2026.
EU Copyright Directive Article 17Article 17 makes large content-sharing platforms liable for copyrighted uploads unless they seek licences, block notified works and prevent re-uploads.
GDPR Article 15: right of accessArticle 15 GDPR lets you find out what data an organisation holds about you, why, and who it shares them with, and get a copy.
GDPR Article 16: right to rectificationArticle 16 GDPR gives a right to have inaccurate personal data corrected without undue delay and incomplete data completed.
GDPR Article 17: right to erasureArticle 17 GDPR gives a right to have personal data erased without undue delay in defined cases; delisting from search engines is its best-known application.
GDPR Article 21: right to objectArticle 21 GDPR lets you object, on grounds relating to your situation, to processing based on legitimate interests; in removal requests it is used together with erasure.
GDPR Articles 33 and 34: breach notificationThe GDPR requires personal data breaches to be reported to the regulator within 72 hours and, where risk is high, to affected people without undue delay.
GDPR Articles 77, 79 and 82: complaint, court action and compensationIf a controller ignores your request, the GDPR offers a complaint to the regulator (77), court action (79) and compensation (82).
Germany BGB §§ 823 and 1004: injunction and removal claimsIn Germany the most common civil remedy against smear content is an injunction and removal claim under §§ 823 and 1004 BGB; hosts must act once notified.
Germany KUG §§ 22 and 23: the right to one's own imageUnder German law a person's image may generally be published only with consent; even the exceptions are limited by the person's legitimate interests.
Germany StGB § 201a: violation of privacy by images§ 201a StGB punishes unauthorised images taken in a home or other protected space, and images exposing a person's helplessness, as well as making them available to others.
Germany StGB §§ 185 to 187: insult, defamation and slanderGerman criminal law treats defamation in three steps: insult (185), unprovable damaging facts (186) and knowingly false facts (187); online publication aggravates the penalty.
Germany's Interstate Media Treaty § 20: right of reply onlineIn Germany, a person affected by factual claims in journalistic online media can require publication of a reply under the Interstate Media Treaty.
Germany's UWG § 4: disparaging and defaming competitorsGermany's Unfair Competition Act bans disparaging competitors and spreading unprovable facts about them that could damage their business.
Turkey's KVKK Article 11: data subject rightsArticle 11 of the KVKK gives anyone whose data is processed the right to ask the controller for information, correction, erasure and compensation.
Turkey's KVKK Article 12: data security and breach notificationArticle 12 of the KVKK requires controllers to secure personal data and to notify affected people and the Board as soon as possible when data is unlawfully obtained.
Turkey's KVKK Article 13: applying to the controllerThe first step in using KVKK rights is a written application to the controller, which must decide within 30 days, normally free of charge.
Turkey's KVKK Article 14: complaint to the BoardIf a controller refuses, answers inadequately or ignores your request, Article 14 lets you complain to Turkey's Personal Data Protection Board within short deadlines.
Turkey's KVKK Article 6: special categories of personal dataArticle 6 of the KVKK subjects special categories such as health, sex life, religion, political opinion, criminal records and biometrics to strict conditions.
Turkey's KVKK Article 7: erasure of personal dataArticle 7 of the KVKK requires personal data to be erased, destroyed or anonymised once the reason for processing ends; it is a core basis for removal requests in Turkey.
Turkish Civil Code Articles 24 and 25: protection of personality rightsArticles 24 and 25 let a person whose personality rights are unlawfully attacked ask a court to prevent, stop and declare the attack unlawful, and to claim compensation.
Turkish Commercial Code Article 55: unfair competition by disparagementArticle 55 treats disparaging others or their products and activities with false, misleading or needlessly hurtful statements as unfair competition.
Turkish Copyright Law Additional Article 4: online infringementFor works used online without permission in Turkey, the rights holder first notifies the content provider, which must remove the content within three days; otherwise the public prosecutor can order access to be stopped.
Turkish Penal Code Article 125: insultArticle 125 makes it a crime in Turkey to attack someone's honour and dignity by alleging a concrete act or fact, or by swearing; insult online is public and attracts a heavier penalty.
Turkish Penal Code Article 132: privacy of communicationsArticle 132 makes it a crime to violate the privacy of communications between people and to unlawfully disclose their contents.
Turkish Penal Code Article 134: violation of privacyArticle 134 makes it a crime to violate the privacy of private life and to disclose images or sounds from it; it is a key provision against non-consensual intimate images in Turkey.
Turkish Penal Code Article 135: unlawful recording of personal dataArticle 135 makes unlawfully recording personal data a crime in Turkey, with heavier penalties for sensitive data such as health, sex life or religion.
Turkish Penal Code Article 136: unlawfully disclosing personal dataArticle 136 punishes anyone who unlawfully gives, disseminates or obtains personal data; it is a strong basis against addresses, phone numbers and ID details being spread online.
Turkish Penal Code Article 138: failure to destroy dataArticle 138 punishes those obliged to destroy data in their systems who fail to do so after the legal retention period has expired.
Turkish Penal Code Article 267: false accusationArticle 267 punishes knowingly false reports to authorities, or allegations through the press, aimed at getting someone investigated or sanctioned.
Turkish Press Law Article 14: right of reply and correctionA person harmed by a periodical publication that attacks their honour or is untrue can require the publication of a reply and correction; the deadlines are short.
UK Defamation Act 2013In England and Wales a statement is defamatory only if it has caused or is likely to cause serious harm; the Act gives website operators a defence and courts power to order removal.
UK Online Safety ActThe Online Safety Act 2023 imposes illegal content duties on UK user-to-user services and search engines, enforced by Ofcom.
US Section 230In the US, Section 230 shields platforms from being treated as the publisher of users' content, so defamation suits against US platforms usually fail.