Turkey’s BTK Imposes Data Localization Requirements on E-SIM Technologies
On March 28, Turkey’s Information Technologies and Communication Authority, the Bilgi Teknolojileri ve İletişim Kurumu, published its decision(dated Feb. 12, 2019) on remote programmable e-SIM technologies imposing localization requirements on e-SIM technologies and prohibition of permanent roaming is once again clarified. The decision also refers to the previous decision of the BTK regarding e-call systems (dated Jan. 22, 2018).
In its previous decision, the BTK indicated that due to the systematic infrastructure of e-call services with e-SIM or modules having SIM card features, they must be procured from authorized operators of electronic communication services in Turkey or reprogrammable in a way so it can be controlled by authorized operators in Turkey, even if it is solely used for emergency calls. The BTK concluded that e-call services cannot be held within the concept of machine-to-machine solutions and technologies, even in cases when it is only used for emergency purposes without a subscription. This finding is in line with the electronic communication regulations and laws in Turkey, as permanent roaming is not allowed under the Electronic Communication Law 5809. Therefore, the BTK decision confirmed this interpretation regarding the fact that e-call service is held as a provision of electronic communication service and thus needs authorization.
The recent decision of the BTK outlines the general use of e-SIM technologies to ensure the promotion of innovative technologies, effective competition, the protection of personal data and consumer rights, maintaining cybersecurity, establishing electronic communication systems as per regulations, and the reduction of difficulties in switching operators.
The recent decision concludes that in cases where remote programmable SIM technologies are used within the borders of Turkey (i.e., devices manufactured for the purposes of use in Turkey or devices imported to Turkey or devices taken to Turkey along with passengers), e-SIM modules in these devices must be programmed in a way so that it can be controlled by authorized operators and local operator profiles must be installed to the device in Turkey (foreign SIM profiles can only be installed outside the customs zone). The decision also outlines that international roaming will be limited to 120 days only; otherwise, their connectivity will be lost. Therefore, devices brought to Turkey by passengers may benefit from international roaming for 120 days only.
The BTK’s recent decision also requires that all structures, servers, software and equipment must be established by an authorized operator or by a third party on behalf of the authorized operators having the sole responsibility and must be kept within the Turkish borders. The decision also states that all data to be kept within Turkish borders. Authorized operators have until Feb. 29, 2020, to comply with these localization requirements.
The BTK decisions confirm that all devices that are to be used in Turkey using e-SIM technologies can no longer be procured from foreign operators through international (permanent) roaming and instead must come from authorized operators in Turkey. Temporary roaming is not affected by these decisions, where it takes less than 120 days to use international roaming services. Global brands providing e-SIM technologies tend to have global framework agreements for international roaming, but they must also deal with nation-specific regulations where authorization/localization may be required. In Turkey, there is no exceptional regulation prepared to accept e-SIM technologies held outside the scope of electronic communication services.
First published by IAPP – Privacy Tracker, 24.04.2019