Digital advertising has undergone a significant transformation in recent years. Advertisers increasingly rely on data relating to consumers’ online behaviour, interests, and preferences to deliver personalised advertisements, while artificial intelligence technologies are becoming more widely used in the creation of advertising content, the use of digital characters, and interactions with consumers. Although these technological developments have enabled advertisements to…
»
Under the Law, the Board has the authority to impose administrative sanctions. It is stipulated that the Board may impose administrative fines for failure to comply with the duty to provide information, obligations relating to data security, failure to comply with decisions issued by the Board, breaches of registration and notification obligations under the Register of Data Controllers, or breaches of the notification obligation regarding standard contracts. In addition to…
»
The Law requires data controllers to notify the Board and the relevant data subject as soon as possible upon becoming aware of a data breach. In its Decision No. 2019/19 dated 24 January 2019 (“the Decision”), the Board has clarified the rules to be applied and the procedures to be followed in the event of a data breach.
The Board adopts the GDPR approach regarding the timing of breach notifications and has clarified that the phrase ‘as soon as possible’ in the Law should be…
»
With the rapid spread of artificial intelligence and its integration into every aspect of life, it has become imperative to establish a legal framework governing the secure and ethical development, deployment and use of artificial intelligence systems, taking into account the complexity and specific characteristics of this technology.
Aiming not only to promote the safe, transparent and human rights-respecting development of artificial intelligence technologies, but also to…
»
Pursuant to Article 16 of the Law, there is an obligation to register with the Data Controllers’ Register (“VERBİS”) for data controllers established in Türkiye that exceed the specified thresholds, as well as for data controllers established abroad that process personal data in Türkiye as data controllers, without being subject to any threshold criteria.
The procedures and principles governing the VERBİS system, which is maintained as a public register, are set out in the…
»
The primary legislation governing the protection of personal data in Türkiye is the Personal Data Protection Act No. 6698 (the “Law”), which came into force in 2016.
The Law, which was drafted on the basis of the European Council’s Data Protection Directive 95/46/EC, is influenced by the provisions of the European Union’s General Data Protection Regulation 2016/679 (“GDPR”), whilst its implementation is influenced by both the GDPR and the decisions of European data protection…
»
