Insights
Transfer of Personal Data Abroad
Sensitive and non-sensitive personal data can be transferred abroad with the data subject’s explicit consent. Other legal grounds also apply to transferring personal data to a foreign country. The destination country must have “sufficient protection” to conclude the transfer abroad based on legal grounds other than explicit consent. The Board is expected to determine a list of jurisdictions that provide sufficient protection. The Board has confirmed that they have been… »
Data Breach Notification
The Data Protection Law requires data controllers to notify the relevant data subject and the Board as soon as possible when being made aware of such data breach. In its decision dated January 24, 2019 and numbered 2019/9, the Board clarified the rules and procedures to be applied in data breach incidents. The Board takes the GDPR approach in terms of timing of breach notifications, and clarified that the term of “as soon as possible” within the Data Protection Law must be… »
Data Controllers’ Registry (VERBIS)
According to Article 16 of the Data Protection Law, an obligation to register in the Data Controllers Registry has been introduced for data controllers. In 2018, the Board issued decisions granting exemptions from registration obligation to certain professional groups, associations, and political parties. The Board also granted a general exemption to local data controllers that have less than 50 employees, and actively less than TRY 25 million on their balance sheets. Data… »
Consequences of Data Breach
The Data Protection Law envisages both administrative fines and criminal liability. With regard to criminal penalties, the Data Protection Law refers to the relevant provisions of the Turkish Criminal Code that detail sanctions for the unlawful recording, or disclosing, or transferring of personal data. In addition to criminal sanctions, the Data Protection Law also contains provisions detailing administrative fines that are to be applied in the event of a breach. There are… »
Judicial Review of Board Decisions
The Data Protection Law does not include an explicit provision concerning the appeal process of Board decisions imposing administrative fines; however, it is accepted that criminal courts of peace are the authorized courts pursuant to Law No. 5326 on Misdemeanours dated 30/3/2005 since the title of Article 18 of the Data Protection Law is “Misdemeanours,” and administrative fines are issued as per Article 18 of the Data Protection Law. Having this in mind, decisions imposing… »
Planned Amendments to the Data Protection Law
Processing Sensitive Personal Data Proposed amendments to the Data Protection Law, which have been drafted by the DPA and which introduce some modifications to certain disputed provisions of the Data Protection Law, have been presented for the related institutions and organisation’s consideration. Articles proposed to be amended are Article 6, regulating the legal grounds for processing sensitive personal data and Article 9, regulation transfer of personal data abroad. Under… »
Draft Guidelines on Cookies Applications
The DPA prepared draft guidelines (“Guidelines”) on January 11, 2022, explaining cookies and practical advice for data controllers who process personal data through cookies. The Guidelines was published on the official website of the DPA on January 11, 2022, to gather views on the same. Within the scope of the Guidelines, which is still at the draft stage, cookies in general and their types are regulated. It also categorises cookies based on their timeframe, intended purpose… »
Named Patient Program
Named Patient Programs (“NPP”) is one of the exceptional importation regimes of pharmaceuticals without marketing authorization (“MA”) in Turkey, or with marketing authorization, but which are unavailable in the Turkish market for various reasons. In cases where a pharmaceutical does not have an MA in Turkey, or has an MA, but cannot be found on the market, and patients are in need the pharmaceutical in question, it is possible to procure the pharmaceutical via this special… »
Interactions with HCPs
Promotional activities of human medicinal products, enteral nutrition products, and infant formulas for special medical purposes, are regulated under the Regulation on the Promotional Activities of Pharmaceutical Products for Human Use (“Promotion Regulation”) dated 3 July 2015. Pursuant to the Promotion Regulation, any advertisement of products to the general public, whether directly or indirectly, through any public media or communication channels, including the Internet… »
Transfers of Value
There is no public disclosure rule for value transfers made by pharmaceutical companies. However, according to the Regulation on the Promotional Activities of Pharmaceutical Products for Human Use (“Promotion Regulation”) dated 3 July 2015, the pharmaceutical companies shall notify TITCK of any value transfers that exceed 10% of the current monthly gross minimum wage, to health institutions, organizations, universities, health professionals, and members of professional… »
Patient Support Programs
An obligation for marketing authorisation holders to apply to the TITCK and obtain permission for training and support programs for patients/healthcare professionals for the rational use of drugs was regulated via Circular numbered 2016/4 dated March 14 2016, published by the TITCK. With the program, the marketing authorisation holder signs a contract with an organisation that has been licensed within the framework of the “Regulation on the Delivery of Home Care Services” to… »
Jurisdiction in Online Infringement of IP Rights
Jurisdiction in the case of online infringement of intellectual and industrial property rights has always been a subject of discussion in Turkish practice. While the claimants suffering from the violation of their rights mostly presuppose that online infringement takes place anywhere in Turkey, so there shall be no geographical boundary on seeking their rights, the parties accused of violation generally rely on the general jurisdiction rules in the civil procedures and assert… »