Transfer of Personal Data Abroad Data Protection Board’s Another Approval Decision
Cross-border data transfers in Turkey has always been a discussed problematic issue as of the enforcement of the Personal Data Protection Code Numbered 6698 (in short “PDPC”).
As a rule, sensitive and non-sensitive personal data can be transferred abroad if the explicit consent of the data subject is obtained.
Article 9/2 of the PDPC provides an exception to this rule and allows for data transfers abroad without the data owners explicit consent provided that some circumstances are met in the Articles 5/2 and 6/3. That being said, if
- sufficient protection is provided in the foreign country where the data is to be transferred or
- the controllers in Turkey and in the related foreign country guarantee a sufficient protection in writing and the Board authorizes such transfer, where sufficient protection is not provided.
Even though Article 9/3 of the PDPC which states that the Personal Data Protection Board (in short “PDPB”) shall determine and announce the countries where sufficient level of protection is provided, it has not published any list of jurisdictions that provide sufficient protection so far.Besides, in practice, the requests of obtaining a permit upon making an application to the PDPB through submission of commitments had been long awaited by PDPB and there were some uncertainties in relation to the adequate and predictable timeline as to obtain a decision from the PDPB and that surely led serious problems for the data controllers.
The PDPB has started for the first time in 2021 to approve the commitments of the firms that already fulfill the necessary requirements set forth in the PDPC and one of those permissions has just been very recently granted with the decision of PDPB dated 22 June 2021 to a global leading French company that is running business in the retail sale of sporting goods and equipment.
Considering the approach of the PDPB in terms of starting to provide permission and the fact that it has still not published the list of jurisdictions so far, making an application to the PDPB with a written commitment stating that sufficient data protection will be provided by both data controllers in Turkey and abroad, can be now considered as an effective solution to be followed in order to transfer the personal data to the destination country.
Our Law Firm remains at your disposal for any further clarifications you may need.