SIGNIFICANT AMENDMENTS TO THE TURKISH DATA PROTECTION LAW

The amendments to the Law numbered 6698 on the Protection of Personal Data (“LPPD”), adopted by Law numbered 7499 on the Amendments of the Code of Criminal Procedure and Certain Laws (“Amending Law”), were published in the Official Gazette numbered 32487 and dated 12 March 2024. Some of those significant amendments are concerning among others (i) the processing of special categories of personal data, (ii) cross-border transfer of personal data, and (iii) administrative fines.

1. Processing of Special Categories of Personal Data
   The current version of the article 6/2 of the LPPD envisages that processing of special categories of personal data is forbidden without the explicit consent of the data subject, with the amendment, article 6/2 of the LPPD is repealed and article 6/3 has been modified through Article 33 of the Amending Law which envisages the new processing conditions for special categories of personal data.Accordingly, the processing of special categories of personal data will only be permitted if one of the following legal grounds is available:
   • With the explicit consent of the data subject,
   • When it is expressly stipulated by law,
   • When processing is mandatory for the protection of life or physical integrity of the data subject or another person who is unable to express consent due to actual impossibility or whose consent is not deemed legally valid,
   • When related to personal data publicly disclosed by the data subject and in accordance with intention of disclosure of the data subject,
   • When processing is mandatory for the establishment, exercise, or protection of a legal right,
   • When required by individuals or authorized institutions or organizations under a confidentiality obligation for the protection of public health, preventive medicine, medical diagnosis, treatment, and care services, and for the planning, management and financing of health services,
   • When processing is mandatory for the fulfilment of legal obligations in employment, occupational health and safety, labor and social security or social services and social assistance,
   • With regards to current or former members and participants or individualsregularly in contact with these organizations, provided that it is processed by foundations, associations, and other non-profit organizations established for political, philosophical, religious or trade union purposes, in compliance with their legislation and objectives, limited to their operational scope, and that it is not disclosed to third parties.
2. Transfer of Personal Data Abroad
   With the amendments, a new alternative and tiered system is established for personal data transfers abroad which bring mainly below three different alternatives:
   1. Transfer of personal data based on the adequacy decision (in Turkish, “yeterlilik kararının bulunması”) of the Personal Data Protection Board (the “Board”, “Kişisel Verilerin Korunması Kurulu”), (with the presence of legal grounds set out in Articles 5 and 6 of the LPPD)
   2. Transfer of personal data based on appropriate safeguards (in Turkish, “uygun güvencelerin bulunması”), (with the presence of legal grounds set out in Articles 5 and 6 of the LPPD and provided that data subject has the opportunity to exercise its rights and to apply for effective remedies in the recipient country)
   3. Transfer of personal data on a temporary basis (in Turkish, “arızi olması”)

   In the absence of an adequacy decision, it is regulated that personal data may be transferred abroad if one of the appropriate safeguards listed below is provided by the parties, provided that one of the requirements set forth in Articles 5 and 6 exists, the data subject has the opportunity to exercise his/her rights and to exercise effective legal remedies in the country where the transfer will be made.

   • The existence of an agreement, that is not qualified as an international agreement, between public institutions and organizations abroad or international organizations, and public institutions and organizations or professional organizations with public entity status in Türkiye, and the permission granted by the Board for such transfer,
   • The existence of binding corporate rules approved by the Board including provisions concerning the protection of personal data for companies within a group engaged in common economic activities,
   • The existence of a standard contract declared by the Board and notification made to the Personal Data Protection Authority (in Turkish, “Kişisel Verilerin Korunması Kurumu”) within five business days regarding the conclusion of the standard contract. Failure to notify may result with an administrative fine ranging from TRY 50,000 (approx. EUR 1,400) up to TRY 1,000,000 (approx. EUR 28,500),
   • The existence of a written undertaking including provisions ensuring adequate protection and authorization granted by the Board.
     If there is no adequacy decision and none of the appropriate safeguards can be provided, only in the presence of one of the conditions foreseen in LPPD and provided that on a temporary basis (in Turkish, “arızi olması koşuluyla”) can the personal data be transferred abroad, only on one of the following conditions:

   • With the data subject’s explicit consent to the transfer personal data, provided that it has been informed about the potential risks,
   • When transfer of personal data is mandatory for the performance of a contractbetween the data subject and the data controller or for the implementation of pre-contractual measures taken at the request of the data subject,
   • When transfer of personal data is mandatory for the establishment or performance of a contract between the data controller and another real person or legal entity for the benefit of the data subject,
   • When transfer of personal data is mandatory for an overriding public interest,
   • When transfer of personal data is mandatory for the establishment, exercise or protection of a right.
   • When transfer of personal data is mandatory for the protection of life or physical integrity of the data subject or another person who is unable to express consent due to actual impossibility or whose consent is not deemed legally valid,
   • In the event of transferring from a registry open to the public or individuals with a legitimate interest, provided that the conditions for access to the registry are met in the relevant legislation and the person with a legitimate interest request it.
3. Legal Remedies
   Kindly note that prior to the amendments, court actions against administrative fines imposed by the Board could be filed at the criminal courts of peace. With the amendments, court actions shall now be filed before the administrative courts against administrative fines imposed by the Board.The amendments shall enter into force as of 1 June 2024.

Our Law Firm remains at your disposal for any further clarifications you may need.

Copyright © 2024 Cailliau&Colakel Attorney Partnership, All rights reserved.