The definition of "Social Network Provider" was first introduced in the amendments made to the Law numbered 5651 on the Regulation of Internet Broadcasts and Prevention of Crimes Committed through Such Broadcasts (“Internet Law”) that came into force on October 01, 2020. These amendments introduced several regulations for social network providers. The Information and Communication Technologies Authority ("ICTA") initially decided the scope and application of the regulations for social network providers in a decision published on October 02, 2020, due to the need for more specific regulations regarding the obligations of social network providers and the sanctions to be applied. With the decision titled “Procedures and Principles about Social Network Provider” published by the ICTA on April 01, 2023 (“Decision”), the previous decision was repealed. While preserving some of the provisions in the previous decision, the new decision introduces significant and controversial new regulations for social network providers.
Key issues covered by the Decision include the following:
- Compared to the previous decision, obligations governing the appointment of representatives have been more precisely regulated. In this case, foreign-based social network companies with more than 1 million daily accesses from Turkey must designate at least one real or legal person as a representative in Turkey.
- In terms of the requirement to appoint a representative for social network providers, it is regulated that the legal entity appointed as a representative must be established in Turkey and have legal personality under Turkish law, while for real person representatives, not only is Turkish citizenship required, but also residency in Turkey is mandatory.
- Suppose the representative of a foreign-based social network provider with more than 10 million daily accesses from Turkey is a legal entity. In that case, a branch must be established in the form of a capital company.
- The representative of a social network provider with more than 10 million daily accesses from Turkey is made fully authorized and responsible in technical, administrative, legal, and financial aspects, without prejudice to the responsibilities of the social network provider.
- The appointment of a capital company as a representative is possible if the following requirements are met: (i) Having a trade name that includes the distinctive phrase of the social network provider's title and the city where the capital company is established; (ii) All of the company’s shares belonging to the social network provider; (iii) Stating in the articles of association that it is incorporated within the organization of the social network provider and is affiliated to the social network provider; (iv) The principal capital must be at least TRY 100 million (approx. EUR 4,7 million); and (v) Explicitly stating in the articles of association that the social network provider holds the representative fully authorized and the representative is fully responsible in technical, administrative, legal, and financial aspects.
- Within the scope of the obligation to send the information and documents of the representative to the ICTA, unlike the previous decision, since real person representatives are required to be residents in Turkey, information and documents proving this must also be sent to the ICTA. If the representative is a legal entity, the legal entity's articles of association, trade registry gazette, and other incorporation-related documents, along with the identification and contact information of the persons authorized to represent and bind the legal entity under the relevant legislation, must be sent to the ICTA.
- If the representative of a social network provider with more than 10 million daily accesses from Turkey is a legal entity, in addition to the requested information and documents for the legal entity representative, the information and documents proving the conditions required for the legal entity representative to be a branch established in the form of a capital company must be sent to the ICTA.
- In case of changes in the information and documents sent within the scope of the obligation to send the information and documents of the representative to the ICTA, unlike the previous decision, the notification obligation within 24 hours has been changed to 72 hours.
- Differing from the previous decision, within the scope of the reporting obligation, social network providers with more than 1 million daily accesses from Turkey are obliged to submit Turkish reports containing statistical and categorical information related to the implementation of decisions on the removal of content and/or blocking access and applications by individuals to the ICTA in six-month periods. With the Decision, the reporting periods have been clarified, with the report covering the period of January 1 - June 30 sent in July and the report covering the period of July 1 - December 31 sent in January.
- Significant regulations have been made regarding the scope and content of reporting to the ICTA.
- One of the significant innovations introduced within the scope of the reporting obligation is the requirement for social network providers with more than 1 million daily accesses from Turkey to create an "Advertisement Library" (brifly the “Ad Library”) and provide it on their website in an easily visible and directly accessible manner. The Ad Library will include information on the advertisement's content, its type, the advertiser, the period during which the advertisement was published, the target audience, the parameters used to define the target audience, and the number of individuals or groups reached with the advertisement.
- One of the most important innovations introduced is the regulation on the obligation to provide information to judicial authorities by the representative in Turkey, if requested by the public prosecutor during the investigation phase and by the court during the prosecution phase, to reach the perpetrators who create or publish internet content related to crimes such as sexual abuse of children, openly spreading misleading information to the public, disrupting the unity of the state and the integrity of the country, crimes against the constitutional order and the functioning of this order, crimes against state secrets, and espionage. There are debates on providing user information requested within the scope of the crime of openly spreading misleading information to the public, which is called the press censorship law and was widely debated when it was published, added to the Turkish Penal Code with Law No. 7418 on Amending the Press Law and Some Laws, will lead to censorship and violate freedom of expression. In case of non-compliance with the obligation to provide information to judicial authorities, it is regulated that the relevant public prosecutor can apply to the Ankara Criminal Court of Peace with a request to narrow the internet traffic bandwidth of the social network provider by ninety percent. If the obligation is fulfilled, it is regulated that the decision to narrow the internet traffic bandwidth will be lifted.
- Again, the much-discussed obligation for user data storage in Turkey requires social network providers with more than 1 million daily accesses from Turkey to take necessary measures to store Turkish users' data.
- One of the new regulations in the decision aims to provide services dedicated to/designed for children. Social network providers are obliged to take into account the child's age, best interest, protection of their physical, psychological, and emotional development, prevention of sexual abuse and commercial exploitation risks, high-level privacy settings for the protection of the child's data, and minimum data processing, as well as presenting contracts, user settings, and data policies in a way that children can understand. Although there is no specific regulation regarding the processing of children's data in the Personal Data Protection Law No. 6698, it is anticipated that the issues mentioned in the recent decision of the Personal Data Protection Board regarding the social media platform TikTok will also be necessary within the scope of the ICTA's decision on social network providers.
- Social network providers are obliged to inform the ICTA and users in Turkish, in a clear and understandable manner, within 72 hours after detecting significant security breaches related to user accounts that directly or indirectly affect users accessing Turkey.
- Regarding situations such as fake user accounts or account theft, social network providers are required to establish a Turkish, clear, understandable, and easily accessible application mechanism and to conclude applications within a reasonable time. Furthermore, social network providers are obliged to establish an effective application mechanism in cooperation with the ICTA to remove title tags and highlighted content through a warning method and provide information about these mechanisms in the periodic reports submitted to the ICTA.
- In the case of learning about content that endangers people's life and property safety and when there is a risk of delay, an obligation to share this content and the information about the content creator with the competent law enforcement units has been introduced.
- Suppose the ICTA requests information from social network providers, including corporate structure, information systems, algorithms, data processing mechanisms, and commercial attitudes. In that case, information must be provided within three months at the latest from the date of notification.
- The Decision also obligates social network providers to create and report a crisis plan for extraordinary public security and health situations.
- Suppose a social network provider does not fulfill the representative appointment notification obligation within 30 days despite the notification made by the ICTA. In that case, no change will be made in the amount of the administrative fine to be applied. A 10 million Turkish Lira (approx. EUR 476,500) administrative fine will be applied to the relevant social network provider in this case.
- If the obligation to respond to applications made by individuals is not fulfilled, a 5 million Turkish Lira (approx. EUR 238,250) administrative fine will be applied; if the reporting obligation is not fulfilled, a 10 million Turkish Lira (approx. EUR 476,500) administrative fine will be applied; if the obligation regarding the advertising library is not fulfilled, a 10 million Turkish Lira (approx. EUR 476,500) administrative fine will be applied.
- The Decision also includes significant sanctions for other obligations. For example, suppose any of the obligations for data storage in Turkey, provision of child-specific separated services, protection of user rights, protection of life and property safety, providing information to the ICTA, and creating a crisis plan are not fulfilled. In that case, an administrative fine of up to three percent (3 %) of the previous calendar year's global turnover can be imposed.
- In case the decision of content removal and/or blocking access is not implemented, it is regulated that the real and legal persons who are resident taxpayers in Turkey may be prohibited from advertising with the relevant foreign-based social network provider for up to six months, and in addition, an application can be made to the peace criminal court to narrow the internet traffic bandwidth by 50% until the said decision is fulfilled. If the decision is not fulfilled within 30 days, an application can be made to narrow the internet traffic bandwidth by up to 90%. The subsequent fulfillment of the decision by the social network provider will not affect the advertising ban; only the measure of narrowing the internet traffic bandwidth will be lifted.
- Suppose administrative fines imposed on foreign-based social network providers under the Decision are not paid. In that case, real and legal persons who are resident taxpayers in Turkey may be prohibited from advertising with the relevant social network provider for up to six months. However, if the social network provider subsequently pays the entire administrative fine, the advertising ban will be lifted.
- Advertising bans to be given within the scope of the Decision will be published in the Official Gazette, and real and legal persons who are resident taxpayers in Turkey and act contrary to the advertising ban will be subject to an administrative fine of 10,000 (approx. EUR 476) to 100,000 Turkish Lira (approx. EUR 4,764).
- With the Decision, the ICTA is also granted the authority to inspect all facilities of the social network provider to examine compliance with the Internet Law.
- It is regulated that social network providers will be directly responsible for the content provided by others through sub-publications in crimes committed through title tags or highlighted content if the unlawful content is reported to them and the content is not removed immediately and within 4 hours at the latest after the notification.
The Decision entered into force on April 01, 2023 without transition period. The Decision, which contains essential regulations and sanctions for social network providers, should be handled carefully, and compliance with these obligations should be ensured.
Special thanks to Aslı Naz Güzel for her contributions.