Transfer of Personal Data to Third Parties
Sensitive and non-sensitive personal data may be transferred to third parties if the data subject’s explicit consent is obtained or if one of the additional legal grounds is applicable for such transfer. The Law does not define a third party; therefore, any individual or entity (other than the data controller and the data subject) may be considered a third party. This creates a problem, especially about transfers between data controllers and data processors, as there is no… »
Transfer of Data Abroad
Sensitive and non-sensitive personal data can be transferred abroad if the data subject’s explicit consent is obtained. Furthermore, other legal grounds will also apply to transferring personal data to a foreign country. However, the destination country must have “sufficient protection” to conclude the transfer abroad based on legal grounds (except for having obtained explicit consent). The Board will determine a list of jurisdictions that provide sufficient protection. The… »
Data Breach Notification
The Law requires data controllers to notify the relevant data subject and the Board as soon as possible after becoming aware of a data breach. In its decision dated January 24, 2019, and numbered 2019/9, the Board clarified the rules and procedures applicable to data breach incidents. The Board took the GDPR approach regarding the timing of breach notifications and clarified that “as soon as possible” within the Law must be interpreted as 72 hours from becoming aware of a… »
Turkish DPA Fines Meta and WhatsApp Try 5,3m For Failure to Fulfill Their Registration Obligation to the VERBIS
The Turkish Personal Data Protection Authority (the “Turkish DPA”),concerning the investigation initiated ex officio, into Meta and WhatsApp which processes the personal data of the data subjects in Turkey and is subject to the provisions of the Law on the Protection of Personal Data No. 6698 (“Law”) over imposed an administrative fine of TRY 2,665,000 (approx. EUR 128,560) separately for failure to fulfill their Data Controller’s Registry (VERBIS) registration and… »
Data Controllers’ Registry (VERBIS)
According to Article 16 of the Law, an obligation to register in the Data Controllers Registry (“VERBIS”) has been introduced for data controllers. In 2018, the Board issued decisions granting exemptions from the registration obligation to specific professional groups, associations, and political parties. The Board also granted a general exemption to data controllers residing in Turkey with less than 50 employees and less than TRY 25 million on their balance sheets. Data… »
Consequences of Data Breach
The Law provides for both administrative fines and criminal liability where data breaches have occurred. Regarding criminal penalties, the Law refers to the relevant provisions of the Turkish Criminal Code that details sanctions for the unlawful recording, disclosing, or transferring of personal data. In addition to criminal sanctions, the Law also contains provisions detailing administrative fines applicable in a breach. Four breaches have been defined under the Law: The… »