Menu
Menu

Data Protection & Privacy Laws

Citizenship-Application-Changes

Recent Constitutional Court Decision Echoes the Importance of Data Protection in M&A Transactions

In the contemporary business landscape of Turkey, the role policies regulating the data protection in M&A transactions has gained unprecedented importance, especially in the realm of mergers and acquisitions (M&A). This heightened significance is propelled by the increasing trend of foreign companies entering the Turkish market through acquisitions.

These transactions, which often involve complex data transfers and integration, place data protection at the forefront of strategic considerations. The effective management of data protection concerns becomes crucial, not just as a compliance requirement, but as a pivotal factor influencing the overall success and legality of M&A transactions.

The surge in M&A activity in Turkey, with its unique legal and cultural landscape, presents various challenges and opportunities. The transference and integration of sensitive data, often spanning across borders, necessitates a nuanced understanding of both local and international data protection laws.

As also highlighted in a recent Constitutional Court case, this is particularly critical considering the potential risks and liabilities that could arise from non-compliance or data breaches. In this context, M&A transactions are not just financial or strategic decisions, but also involve careful consideration of data privacy and security, making them key determinants in the valuation and success of such deals.

I. Data Protection Legislation and Rules in Turkey

In Turkey, the keystone of data protection legislation is the Law on Personal Data Protection No. 6698 (the LPDP), which established a comprehensive framework for handling personal data. The LPDP was a significant step towards aligning Turkish law with international data protection standards, particularly the European Union’s General Data Protection Regulation (GDPR). Key provisions of the LPDP include the requirement for explicit consent for data processing, data subject rights, and obligations for data controllers and processors.

Under the LPDP, both domestic and cross-border data transfers typically require the prior explicit consent of the data owner. Nevertheless, the LPDP provides exceptions to this requirement, applicable to personal data and personal data of special nature, as outlined in Article 5/2 and 6/3, respectively. For personal data, Article 5/2 allows processing and transfer to third parties without explicit consent in cases:

  • Mandated or required by law,
  • Necessary to protect the life or physical integrity of a person unable to provide consent,
  • Essential for executing services outlined in a contract,
  • Required for the data controller to fulfill its legal obligations,
  • Publicly disclosed by the data owner,
  • Deemed mandatory for establishing, exercising, or safeguarding rights, or
  • Necessary for the legitimate interests of the controller, provided it doesn’t violate the data owner’s fundamental rights and freedoms.

Understanding these rules is crucial for entities involved in M&A transactions, as data protection compliance becomes a critical component of the due diligence process. Non-compliance with the LPDP can result in significant legal and financial repercussions, emphasizing the importance of thorough understanding and implementation of these principles in all business activities involving personal data.

For more detailed information on the LPDP and the principles of lawful data processing, you can refer to ASY Legal’s articles on Personal Data Protection in Turkey and 8 Principles for Lawful Personal Data Processing.

2. Importance of Data Protection in M&A Transactions

One of the critical challenges in M&A transactions is securing data in data rooms, which are essential for due diligence processes. These virtual spaces, where sensitive corporate information is stored and shared, are often accessed by third parties, such as potential buyers and legal advisors. This accessibility poses a substantial risk for data breaches, making the security of these data rooms paramount.

In addition to the risks during the due diligence phase, the very nature of M&A transactions, which involve the transfer of ownership and control of companies, inherently implies the transfer of data. This transfer raises significant concerns about data privacy, as the data collected and controlled by one entity (the target company) transitions to another (the acquiring company). Ensuring that this transition complies with data protection laws, especially when dealing with personal data, is a complex and vital aspect of the transaction.

Additionally, during the post-M&A integration phase, aligning the data protection policies of the merging entities is crucial. The acquiring company must not only understand the data protection practices of the target company but also seamlessly integrate these practices within its existing framework. This integration involves reconciling differences in data handling, storage, and processing protocols, ensuring continued compliance with LPDP and other relevant data protection regulations.

Cross-border mergers add another layer of complexity. The LPDP in Turkey addresses cross-border data transfers by requiring explicit consent except under certain conditions. However, a significant challenge is presented by the lack of a definitive list from the Data Protection Board (DPB) of countries deemed to have sufficient data protection measures.

This absence means the exemptions usually allowed under Article 9/2 of the LPDP are not applicable, including those countries subject to the General Data Protection Regulation (GDPR), complicating cross-border data transfers. For more information, please refer to our previous articles on this subject here.

3. Recent Constitutional Court Case Highlights the Importance of Due Diligence

In the realm of mergers and acquisitions,, the significance of thorough due diligence cannot be overstated, particularly when the target company belongs to a high-risk data group. These companies, like hotels, tourism agencies and hospitals, process vast quantities of personal data and are susceptible to data breaches and legal violations. The implications of such breaches become particularly critical in M&A transactions, as they may not have been previously detected by the Data Protection Board. This oversight can lead to substantial challenges post-acquisition, where the new owner might face administrative fines for the predecessor’s actions.

A pertinent case illustrating these risks involves a global hotel chain’s experience in Turkey. The case, adjudicated by the Turkish Constitutional Court, highlights the complexities and legal ramifications in such scenarios.

a. The Case Overview & Background

The Constitutional Court’s decision, dated 12.10.2023 (numbered 2020/7518), published in the Official Gazette on 15.12.2023, revolved around an administrative fine imposed by the Data Protection Authority (the DPA) on a global hotel chain. DPA penalized the chain for failing to ensure data security, consequently infringing on the company’s property rights.

The issue originated on 08.09.2018, when a data breach in the guest reservation database of a company acquired in 2016 was detected. This breach, affecting 500 million customers’ personal data, had remained undetected since unauthorized access began in July 2014. The new owner of the hotel chain reported the breach to DPA in 2019, as it impacted Turkish citizens.

b. DPA’s Decision and the Fine

After careful consideration, DPA decided to impose a fine totaling TRY 1,450,000 on the hotel chain. This comprised TRY 1,100,000 for failing to secure data as required by Article 12/1 of the Personal Data Protection Law (PDPL) and TRY 350,000 for delayed breach notification (Article 12/5 of the PDPL). DPA overlooked the hotel chain’s argument that the breach predated the acquisition, thus not considering the acquired company as the data controller.

c. Legal Challenges and Court Decisions

The hotel chain contested this fine, arguing several points including the misapplication of the PDPL, insufficient notification of DPA’s decision, and the imposition of the fine at the maximum threshold. However, their central claim was that the breaches occurred before the acquisition and during the previous owner’s tenure.

As a result, they argued that such penalties should be issued to the party that was responsible at the time of the breach, due to the principle of the individuality of penalties. The hotel chain further argued that they were not late in reporting the breach to DPA, as there are no defined durations or time limits for such reporting and declarations noted in the LPDP.

The Istanbul Anatolian 1st Criminal Court of Peace and subsequently the Istanbul Anatolian 2nd Criminal Court of Peace reviewed the appeal and dismissed these objections, upholding DPA’s decision. However, the Courts did not provide adequate reasoning for their judgements and did not even provide any justifications for why the appeal was rejected.

d. The Constitutional Court’s Ruling

The case was later referred to the Constitutional Court by the hotel chain. The Constitutional Court, upon its review, underscored the right to property, the necessity for proportionate interventions in such rights, and the need for detailed judgements with reasoning for why a specific decision is given by the relevant courts. The Constitutional Court, therefore, found the lack of a proper assessment of the chain’s claims against DPA’s decision as a violation of this right. The Court called for a re-trial, emphasizing the need for an effective judicial review of DPA’s decisions.

e. Future Implications on Data Protection in M&A Transactions

This case highlights the crucial role of effective judicial review in administrative fine decisions related to data protection. The decision supports long-standing criticisms about the inadequacy of criminal courts of peace in handling such matters, advocating for the involvement of administrative courts instead.

However, it is important to note here that the Constitutional Court’s decision does not mean that the administrative fine issued by DPA was illegitimate, as the Court actually finds the fine to be within the parameters of the law. Instead, the Court accepted the application based on the insufficient reasonings and judgements issued by the first instance courts.

The implications of this ruling for M&A transactions are profound and far-reaching. Since the Constitutional Court actually found that fines issued by the DPA to be within the confines of the law, the decision accentuates the critical importance of meticulous due diligence in evaluating the data protection practices of target companies. This is especially pivotal for companies in high-risk data groups, where potential breaches can have significant legal and financial consequences.

The substantial fines imposed in this case serve as a stark reminder of the repercussions that may ensue. Thus, acquirers are compelled to rigorously assess the data security measures of potential acquisition targets. This not only helps in mitigating risks but also ensures strict compliance with data protection laws, safeguarding the acquirer from potential liabilities and fines.

4. Administrative Fines for Data Protection Breaches

The recent Constitutional Court case shows the significant role administrative fines play in data protection violations, which can go up to TRY 10.000.000, depending on the nature of the violation. The Data Protection Authority holds discretionary power in determining the exact amount of these fines, taking into account factors such as the specifics of each case, the nature of the infringement, and the economic condition of the perpetrator, which makes it extremely difficult to contest and revoke.

For M&A transactions, it’s critical to be aware that non-compliance with data protection regulations can result in hefty fines. In certain cases, these fines may exceed 3 million TRY per breach or instance of non-compliance. This underlines the importance of ensuring that the target company adheres strictly to data protection laws to avoid such penalties.

The administrative fines are subject to legal challenges, and recent court rulings suggest that some fines imposed by the DPA might not adequately consider the nature of the infringements or the economic conditions of the data controllers/processors. Consequently, there is a growing emphasis on the need for fair and proportionate imposition of fines, ensuring that they reflect the specifics of each case. As highlighted in the previous case review, challenging these fines can be a lengthy process. Even if a fine is contested in court, the fined entity must initially pay and await the court’s ruling for any potential reimbursement, presenting significant challenges.

5. Ensuring Compliance During and After M&A Transactions

Due to the risks involved, snsuring compliance with data protection laws during and after mergers and acquisitions (M&A) is crucial to avoid potential administrative fines and legal issues. This involves several key strategies:

  1. Rigorous Due Diligence: Conduct thorough checks on the target company’s data protection policies and practices. This includes reviewing their compliance history, data handling procedures, and any past data breaches or legal issues related to data protection.
  2. Comprehensive Data Audits: Assess the data being transferred during the M&A process to identify any sensitive or regulated data, ensuring it’s handled in compliance with legal requirements.
  3. Employee Education and Training: Educate and train all individuals who will have access to sensitive data about proper data handling and compliance procedures. This step is vital to prevent accidental breaches or non-compliance.
  4. Implementing Robust Data Protection Policies: Develop and implement robust data protection policies that align with current legal standards. These policies should be clearly communicated and enforced across the merged entity.
  5. Regular Compliance Reviews: After the merger, regularly review and update data protection practices to ensure ongoing compliance. This includes monitoring changes in data protection laws and adjusting policies accordingly.
  6. Engagement with Data Protection Experts: Engage with legal experts or data protection officers to provide ongoing guidance and support in maintaining compliance.

These steps help in minimizing the risks associated with data protection non-compliance and ensure a smooth transition during and after the M&A process.

Recent Constitutional Court Decision Echoes the Importance of Data Protection in M&A Transactions

Av. Ali Yurtsever

Contact for consulation

Author Bio
Biometrics-7

Biometric Signatures in Turkey: Legal Implications and Data Protection Concerns

I. Introduction to Biometric Signatures in Turkey

Biometric signatures, a contemporary convergence of technology and personal identification, represent a new frontier in the world of electronic and digital validation. At their core, biometric signatures are an offshoot of biometric data. This data, renowned for its inherent association to an individual and its typically unchangeable nature, provides unique attributes that distinguish it from conventional data. Its inability to be altered or forgotten, rooted in its innate connection to the individual, renders biometric data distinct from other forms of information.

Yet, as we venture deeper into the realm of digital transactions and electronic authentication, we encounter a blend of different regulations that can vary significantly across jurisdictions. The European Union, with its systematic and broad-based approach, has developed a comprehensive regulatory framework encapsulating various forms of electronic and digital signatures. The eIDAS Regulation, a notable pillar in this construct, provides clear definitions between different levels of electronic signatures, ranging from ‘simple’ to advanced and qualified signatures.

On the contrary, biometric signatures in Turkey presents a contrasting picture. While the EU’s regulatory framewokr offers clarity and comprehensive coverage, Turkey’s approach appears narrower. The country’s regulatory landscape, predominantly focusing on “qualified electronic signatures”, leaves other types of electronic and digital signatures unregulated. This limited framework leads to significant gray areas, prompting questions about the validity, recognition, and enforceability of various e-signatures within the Turkish jurisdiction.

In this article, we’ll dive into biometric signatures, looking at how they fit into the wider landscape of digital rules in both the EU and Turkey

II. Differentiating Types of Signatures: Electronic, Digital, and Biometric

Before we delve deeper into biometric signatures, it’s pivotal to understand the distinction between electronic signatures, digital signatures, and biometric signatures. The eIDAS Regulation provides a structured approach to electronic signatures:

  • ‘Simple’ electronic signatures: Defined as “data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign”. Essentially, appending your name under an email could be a ‘simple’ electronic signature.
  • Advanced electronic signatures (AdES): Beyond the basic electronic signature, an AdES is uniquely tied to the signatory and allows them complete control. Moreover, it’s linked to its associated document in a way that any subsequent changes can be detected. The most prevalent technology ensuring this is public-key infrastructure (PKI), encompassing the use of certificates and cryptographic keys.
  • Qualified electronic signatures (QES): A QES is an enhanced version of the AdES, created by a qualified signature creation device (QSCD) and founded on a qualified certificate for electronic signatures.

While electronic and digital signatures primarily revolve around data validation and user authentication, biometric signatures capitalize on the unique physical or behavioral characteristics of the signatory. It’s crucial to note the position of Turkish regulations in this context. Turkish regulations only recognize “qualified electronic signatures” (QES) as valid signatures. Other forms, including simple and advanced electronic signatures, aren’t fully acknowledged as official signatures in the country, rendering them with limited legal standing. This distinction becomes more pronounced when considering the evolution and the potential legal recognition of biometric signatures in Turkey

III. Understanding Biometric Signatures

Biometric signatures involve the use of specific biometric data to create signatures on a dedicated tablet or pad, with these data often securely linked to the signed document. It is important to clarify that while biometric signatures share some similarities with traditional handwritten signatures, they are distinct concepts. Unlike traditional wet signatures created with pen and paper, biometric signature solutions lack a standardized framework, resulting in diverse design features and differing functionalities.

The crucial differentiation between biometric signatures and traditional handwritten signatures lies in the manner in which they are evaluated. In the context of data privacy, the essence of biometric signature analysis hinges on dynamic characteristics, considering factors like the amount of pressure applied during the signature, the angle of writing, the speed and acceleration of the stylus, the formation of letters, the orientation of the signature, and other unique dynamic attributes. This contrasts with traditional signatures, which primarily focus on the visual appearance of the signature.

IV. Legal Aspects of Biometric Signatures: eIDAS, LPDP and Beyond

a. EU vs Turkey

The examination of biometric signatures in the context of legal and regulatory frameworks reveals a multifaceted landscape. Biometric signature solutions exhibit variations in design and implementation standards, largely due to the absence of a universal global standard governing their development and utilization. In contrast, the European Union has taken substantial strides in crafting a cohesive framework for electronic identification and trust services within the digital single market. This framework, known as the “Electronic Identification and Trust Services Regulation” (eIDAS), provides a structured approach to these matters, offering a measure of clarity within the EU.

However, when we shift our focus to Turkish legislation, we encounter a dearth of similar clarity. The distinctions between biometric and handwritten signatures and their compatibility with existing legal structures become increasingly pronounced. The absence of a specific legislative framework catering to biometric signatures within Turkey raises pertinent questions about their status and recognition under the law. This ambiguity underscores the necessity for a rigorous legal analysis to elucidate the position of biometric signatures within the Turkish legal landscape.

b. TCC, LPDP and the Data Protection Board Decision

The inclusion of biometric signatures within the legal framework poses intriguing questions, particularly regarding their compatibility with the provisions of Turkish Code of Obligations No. 6098 (the “TCC”). In the 14th and 15th articles of the TCC, which delineate the fundamental principles of contract formation, the requirement for signatures is stipulated as a handwritten act. This emphasis on the act of signing exclusively by hand prompts a pertinent query: Can biometric signatures be evaluated within the purview of Article 6, paragraph 3, of Turkish Law on the Protection of Personal Data No. 6698 (the “LPDP”)?

The distinction between traditional handwritten signatures and biometric signatures hinges on the evaluation process. Traditional handwritten signatures rely on static or geometric attributes—how they visually appear. In contrast, biometric signatures focus on dynamic characteristics, scrutinizing the process of signature creation. A comprehensive analysis of biometric signatures considers dynamic elements such as the pressure applied during signing, the angle and speed of the stylus, the formation of characters, the direction of the signature, and an array of other distinctive dynamic features.

In a pivotal decision with the docket No. 2020/649, the Turkish Data Protection Board weighed in on this very matter. Their perspective emphasized that the term “signature” within the TCC includes the traditional handwritten signature and the secure electronic signature. While these two types of signatures produce similar legal outcomes, the board noted that the legislator distinctively regulates both. Expanding the TCC provisions to cover biometric signatures might lead to an overly broad reading of the exception in Article 6, paragraph 3, of the LPDP, potentially clashing with the principle of proportionality. As such, the board suggested careful handling of biometric signatures, requiring:

  • Express consent from related individuals,
  • Proper notification under Article 10 of the LPDP,
  • Adherence to the “Adequate Measures” determined by the Board when processing sensitive personal data, as per Article 6, paragraph 4, of the LPDP.

In light of these points, it’s clear that biometric signatures raise intricate legal questions that demand thoughtful analysis within the existing Turkish framework.

V. Using Biometric Data & Biometric Signatures

In the realm of data protection, the use of biometric signatures is intertwined with intricate legal considerations. LPDP categorizes biometric data as a special subset of personal data. Such data’s processing, devoid of explicit consent, is sanctioned solely when other laws authorize it. A prime example is the provision for collecting biometric data for health services under Article 67 of Law No. 5510, Social Security and General Health Insurance Law.

For a deeper exploration into the intricacies of biometric data in Turkey, including critical insights from the European Court of Human Rights (ECHR) and the Turkish Data Protection Authority (DPA), readers are encouraged to consult our detailed article: “Unlocking the Use of Biometric Data in Turkey: Critical Insights from ECHR and the Turkish DPA”.

When processing biometric data, it is crucial to adhere to the following conditions:

  • Explicit Consent: Biometric data processing generally requires explicit consent from data subjects.
  • Information Obligation: Data controllers must provide clear and comprehensive information to data subjects about the data processing.
  • Measures for Data Security: To protect the integrity and confidentiality of biometric data, stringent security measures must be in place.

a. Biometric Data in the Healthcare Sector

In the healthcare sector, Article 67 of Law No. 5510 allows state hospitals to request biometric data to verify patients’ identities when receiving healthcare services. This practice has sparked debates over privacy rights. However, the Constitutional Court ruled that this provision does not violate the Constitution, emphasizing the significance of preventing corruption in public offices and the enhanced security offered by biometric verification.

b. Biometric Data for Employee Shift Controls

Large companies and holdings often employ biometric data for tracking employee working hours. However, the use of fingerprint scanners for such purposes raised legal challenges. The Council of State ruled that fingerprints are an integral part of an individual’s private life and thus protected under the right to privacy (Article 20 of the Constitution). It was determined that other equally effective methods exist for tracking employee shifts, and forcing employees to use fingerprint scanning systems was deemed unconstitutional.

c. Biometric Data for Secure Rooms

The implementation of secure rooms, especially in tech companies for safeguarding confidential information, has led to the demand for biometric data. Companies may require employees to provide biometric data for access to these rooms. While high courts have yet to provide specific rulings on this matter, the Council of State’s decision regarding biometric data for employee shift controls suggests that employees cannot be compelled to provide such data for secure room access. Consent-based data collection remains a viable option, provided that consent is obtained meticulously.

VI. Conclusion

The intersection of biometric signatures and Turkish law is marked by both promise and ambiguity. While technology paves the way for innovative and secure means of authentication, the regulatory landscape in Turkey remains cautious, emphasizing the imperatives of explicit consent and robust data protection measures. Different scenarios, be it healthcare, employee management, or secure areas, each come with distinct legal nuances, underscoring the importance of a judicious approach. As we stand on the cusp of a digital transformation, the evolving narrative of biometrics in Turkey serves as a compelling testament to the intricate dance between technological advancement and legal adaptation. The path forward beckons a harmonized approach, championing both individual rights and the burgeoning potentials of biometrics.

Medical-toruism-2

Setting Up Health Tourism Services in Turkey

A Strategic Guide for Investors

Airplane and medical equipment, symbolizing health tourism in Turkey

I. Intorduction

Turkey’s prominence in the global medical tourism sector has grown steadily over recent years. With the country attracting approximately 338,000 foreign patients in 2020, this number surged to 624,444 in 2021 and reached 1.258 million in 2022. Projections suggest that by 2023, this figure could touch 1.8 million.

This growth is driven by two primary factors: the cost-effective healthcare services Turkey offers compared to other countries with advanced healthcare systems, and the nation’s commitment to ensuring safety through strict regulatory measures. These regulations not only enhance the trust of international patients but also set high standards for service providers in the health tourism sector.

For potential investors eyeing Turkey’s health tourism market, understanding the legal and regulatory landscape is crucial. New entrants need to meet specific criteria and acquire the necessary licenses to operate legally. This article delves deep into the legal requirements, offering a comprehensive guide for those looking to invest in health tourism in Turkey. For readers seeking a quick overview, please refer to our summary roadmap for investing in the health tourism sector in Turkey.

Turkey’s health tourism sector operates within a robust legal framework, ensuring quality and safety standards are upheld. Key legislative texts governing the industry include the Law on the Method of Execution of Medicine and Medical Sciences No. 1219 (referred to as the Medical Law) and the Law on Health Care Services No. 3359 (known as the Healthcare Law). Additionally, a series of secondary regulations and communiqués further detail the operational specifics.

To legally provide services of health tourism in Turkey, entities must obtain the necessary licenses from Turkey’s Ministry of Health. However, the licensing process is multi-layered, with potential providers needing to first secure a Group A Tourism Agency License from TURSAB (Association of Turkish Travel Agencies) before they can apply for the Medical Tourism Intermediary Agency License from the Ministry of Health. Each license has its own set of prerequisites, making it essential for new entrants to be well-versed with the requirements.

a. Group A Tourism License

As stipulated in Article 5 of the Health Regulation, intermediary agencies aiming to provide services of health tourism in Turkey must first obtain a Group A Tourism Agency License. This requirement is further elaborated in the Law on Tourism Agencies and Tourism Agency Associations No. 1618 (the Tourism Law) and its accompanying Tourism Agencies Regulation.

To secure this license:

  • Investors need to establish a capital company, ensuring that the company’s articles of association include specific clauses relevant to health tourism.
  • Once the company is set up, an application for the reservation of a tourism agency title must be submitted to the Ministry of Culture and Tourism.
  • Following approval, a separate application is made to TURSAB for the Group A Tourism License.
  • Meeting the criteria mentioned in the Regulation is essential, which includes having a suitable office space, maintaining required company documents, and employing qualified personnel.
  • The TURSAB membership fee for 2023 is 226,856.51 TL.

b. Health Tourism Certificate

After obtaining the Group A Tourism License, entities can apply for the Health Tourism Certificate from the Ministry of Health. This certification ensures that the provider meets the standards for health tourism services. The application process includes:

  • Submitting signed protocols with licensed medical facilities.
  • Demonstrating infrastructure capabilities, such as having a functional call center.
  • Employing qualified personnel as per the Ministry’s standards.
  • Post-application, an inspection from the Ministry verifies the operational readiness of the applicant, ensuring that they possess the necessary technology and equipment.

It’s worth noting that currently, over 800 licensed health tourism companies operate in Turkey, with almost 60% based in Istanbul (data available here).

III. Data Protection and Compliance in Health Tourism in Turkey

The advent of digital health records and international patients’ mobility has amplified the importance of data protection within the health tourism sector. Ensuring the privacy and security of personal health data is not just an ethical obligation but also a stringent legal requirement in Turkey. Further details on personal data processing in Turkey can be found in our earlier article, Principles for Lawful Personal Data Processing and Personal Data Protection in Turkey.

a. The Law on Personal Data Processing (LPDP)

The primary legislative framework governing data protection in Turkey is the Law on Personal Data Processing (LPDP). The LPDP classifies health data as ‘sensitive personal data,’ mandating stricter protections and processing conditions compared to other data types.

Any health tourism service provider will be inherently dealing with health data, which necessitates strict adherence to the LPDP’s guidelines. Potential breaches can have severe legal and financial repercussions.

b. Registration with the Data Controllers’ Registry (VERBIS)

VERBIS is a public database maintained by the Data Protection Board, under the Turkish Data Protection Authority (DPA). Unless exempted, all entities processing personal data in Turkey must register with VERBIS.

Given the nature of health tourism, agencies dealing with sensitive health data are required to register with VERBIS, irrespective of their size or annual financial figures. The criteria for mandatory registration include:

  • Entities with more than 50 employees annually or an annual financial statement exceeding TL 100,000,000.
  • Entities primarily processing sensitive personal data, even if they fall below the aforementioned thresholds.

It’s crucial for health tourism agencies to ensure timely registration with VERBIS, aligning their data processing activities with the stipulated guidelines.

c. Compliance with Data Processing Principles

Agencies looking to provide services of health tourism in Turkey must ensure:

  • Data is processed lawfully and fairly.
  • Processing activities are compatible with the purposes specified during data collection.
  • Data is accurate, up-to-date, and relevant to the purpose of processing.
  • Data storage periods adhere to legal or business practice requirements.

Given the sensitive nature of health data, obtaining explicit and informed consent from patients is paramount. Health tourism agencies must ensure that patients are aware of:

  • The purpose of data collection and processing.
  • The scope and nature of the data being processed.
  • Their rights concerning data access, correction, and deletion.

e. Data Breach Protocols & Third Party Agreements

In the unfortunate event of a data breach, providers of health tourism in Turkey must have protocols in place to swiftly notify affected individuals and the Data Protection Authority. Such measures are vital to mitigate potential damage and ensure compliance with regulatory mandates.

Often, health tourism agencies collaborate with hospitals, clinics, and other healthcare providers. In such scenarios, clear data sharing and processing agreements are essential. These agreements must outline the nature of data sharing, storage protocols, and mutual responsibilities concerning data protection.

IV. Strategic Roadmap for Investors

The robust growth of health tourism in Turkey underscores an attractive opportunity for investors. However, navigating the intricacies of the legal landscape and operational requirements can be challenging. This section aims to provide a roadmap for potential investors to set up health tourism services in Turkey seamlessly.

a. Initial Market Research

Before venturing into the sector of health tourism in Turkey, it’s essential to understand the market dynamics. Factors to consider include:

  • The most sought-after medical procedures by international patients.
  • Prominent medical tourism destinations within Turkey.
  • The competitive landscape and existing key players.

b. Establishing a Capital Company

To enter the sector of health tourism in Turkey, investors will need to establish a capital company. This involves:

  • Deciding on the company type (e.g., joint-stock or limited liability company).
  • Drafting the company’s articles of association, ensuring they include specific clauses related to health tourism operations.
  • Registering the company with the relevant authorities.

c. Licensing and Regulatory Compliance for Health Tourism in Turkey

As discussed in previous sections, multiple licenses are required to operate in the health tourism sector. Investors should:

  • Apply for the Group A Tourism License from TURSAB.
  • After obtaining the Tourism License, seek the Medical Tourism Intermediary Agency License from the Ministry of Health.
  • Ensure compliance with data protection laws, especially when processing sensitive health data.

d. Building Collaborative Networks

Success in health tourism relies heavily on collaborative efforts. Investors should:

  • Establish partnerships with accredited hospitals, clinics, and healthcare providers.
  • Foster relationships with travel agencies and accommodation providers to offer comprehensive health tourism packages.

e. Ensuring Quality and Safety

To build trust and ensure repeat business, it’s crucial to prioritize patient safety and service quality. Measures include:

  • Ensuring partnered medical facilities adhere to international standards.
  • Regularly training staff on best practices in health tourism.
  • Obtaining feedback from international patients to continually improve services.

f. Marketing and Brand Building

For a health tourism business to thrive, effective marketing is key. Strategies to consider:

  • Building a professional website optimized for international search engines.
  • Engaging in digital marketing, targeting potential patients in countries known for seeking health services in Turkey.
  • Attending international health tourism conferences and expos to build brand visibility.

g. Staying Updated

The health tourism landscape is dynamic, with evolving patient preferences and regulatory changes. To remain competitive, investors should:

  • Regularly update themselves on changes in the Turkish healthcare system and regulations.
  • Monitor global health tourism trends to anticipate and cater to emerging patient needs.

V. Conclusion: A Promising Investment Horizon in Health Tourism

The sector of health tourism in Turkey has rapidly evolved into a lucrative market, not just for medical professionals but also for astute investors keen on tapping into this growth trajectory. The unique blend of high-quality medical services, cultural heritage, and picturesque landscapes make Turkey an appealing destination for international patients.

For investors, while the potential for returns is significant, the journey is not without its challenges. The legal and regulatory framework is stringent, reflecting the government’s commitment to ensuring the highest standards of patient care and safety. Understanding these legal intricacies, from company formation to data protection, is crucial for smooth operations and long-term success.

The roadmap provided in this guide offers a strategic approach to navigate the complexities of setting up services of health tourism in Turkey. From initial market research to comprehensive marketing strategies, each step has been delineated to aid potential investors in making informed decisions.

In summary, with meticulous planning, adherence to regulations, and a relentless focus on patient welfare, investors can unlock a world of opportunities in Turkey’s burgeoning health tourism sector. As the industry continues to grow, now is the opportune moment for investors to make their mark and contribute to Turkey’s meteoric rise as a global health tourism hub.

Biometrics-4

Unlocking the Use of Biometric Data in Turkey

Criticial Insights from ECHR and the Turkish DPA

Equipment for processing biometric data in Turkey.

I. Introduction

In a world where the digital realm has become deeply intertwined with our daily lives, the importance of data protection cannot be overstated. Turkey, as a part of its commitment to safeguarding its citizens’ rights, has enacted stringent regulations regarding the processing of personal and biometric data. This article delves deep into Turkey’s legal landscape concerning data protection and especailly the usage of biometric data in Turkey, providing a comprehensive overview for anyone navigating this intricate subject.

II. Applicable Legislation in Turkey for Data and Biometric Data Processing:

The primary legislation governing the processing of personal data in Turkey is the Personal Data Protection Law (PDPL), numbered 6698. The PDPL aims to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, concerning the processing of personal data.

Under the PDPL, personal data refers to any information relating to an identified or identifiable natural person. When this personal data reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processes genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, it is classified as ‘specialized personal data.’ Biometric data, which has gained significance in various sectors due to technological advancements, falls under this special category, mandating stricter processing rules.

The PDPL is complemented by various secondary regulations and decisions made by the Personal Data Protection Board (The Board). The Board plays a crucial role in interpreting the PDPL and providing guidance on its implementation.

III. Understanding Personal Data: A Deep Dive into Turkey’s PDPL Article 3(a) and 6(1)

Within the framework of Turkey’s Personal Data Protection Law (PDPL), there are distinct classifications for data. At the heart of these definitions lies what’s termed as ‘personal data’, as defined in Article 3(a) of the PDPL. This data encompasses any information relating to an identified or identifiable natural person, covering a broad spectrum from basic details like names and addresses to more technical data like IP addresses.

However, there’s a subset of personal data that demands greater attention due to its sensitivity – the ‘special categories of personal data’. Article 6(1) of the PDPL delves deeper into this, highlighting data types that reveal racial or ethnic origin, political stances, religious or philosophical beliefs, and even trade union memberships. A standout in this category is biometric data. With its unique capability of identifying individuals, biometric data’s inclusion under this category underscores its significance and sensitivity.

IV. Navigating Data Rights and Obligations in Turkey: Insights from PDPL Articles 11 and 12

The PDPL is not just about defining data; it’s also a guiding light on the rights of data subjects and the obligations of those who control the data. Article 11 of the PDPL notes the rights of data subjects. It empowers individuals to know if their data has been processed, to understand the purpose behind such processing, and to be informed about third parties involved in such transactions, be it domestic or international.

Furthermore, individuals can request rectification of their data if it’s processed inaccurately, and they have the right to object to any results emerging from automated system analyses of their data. If there’s any infringement, the law grants them the right to claim damages.

On the flip side, data controllers have their set of obligations outlined in Article 12 of the PDPL. They must ensure the security of personal data, keep data subjects informed about any breaches, and register with the Data Controllers’ Registry. Moreover, they’re required to prepare a Personal Data Processing Inventory and, if necessary, appoint a Data Protection Officer.

V. The Rise of Biometrics in Turkey’s Private Sector: Real-world Applications and Implications

Biometric data is not confined to legal discussions. Its practical applications are widespread across various sectors in Turkey. The health sector, for instance, leverages biometric data, especially genetic data, for diagnostics, treatment planning, and tailoring medicine to individual needs. The utilization of biometric identification in hospitals and clinics for patient registration ensures accuracy and prevents medical mishaps.

In the realm of business, many firms have turned to biometric systems for employee monitoring, by trying to find ways to implement fingerprint or facial recognition technologies offer precise timekeeping and enhanced security. These efforts were subsequently blocked by Board decisions.

The technological domain has also embraced biometrics . The gadgets we use daily, be it smartphones, tablets, or computers, now come equipped with fingerprint scanners, facial recognition, and even voice recognition features. It’s a testament to how intertwined biometrics has become with our daily lives.

Lastly, the security sector in Turkey holds biometrics in high regard. The unparalleled identification accuracy offered by biometrics is evident in high-security areas where access control is paramount. Even surveillance systems now employ facial recognition technology, emphasizing the role of biometrics in modern security protocols.

VI. Case Precedents Regarding Biometric Data

a. Biometric Data on the International Stage: The GLUKHIN v. Russia Case

In a landmark judgment, the European Court of Human Rights (ECHR) has ruled on the use of facial recognition technology and the rights to privacy and freedom of expression in the case of Glukhin v. Russia.

Glukhin held a solo demonstration in Moscow, which was captured and subsequently published on a public Telegram channel. The police discovered this content during routine internet surveillance. In their investigation, they made screenshots of the Telegram channel and employed facial recognition technology on them to identify Glukhin. Furthermore, after deducing the location in the video as a Moscow subway station, they garnered video recordings from CCTV surveillance cameras from that station and two others Glukhin passed through. Notably, these recordings were later utilized as evidence against him in administrative proceedings.

The court’s decision (which can be accessed here) accentuated the importance of a transparent and robust legal framework for collecting, storing, and using biometric data. Therefore, the court determined that there had been a violation of both Article 8 (right to respect for private life) and Article 10 (freedom of expression) of the Convention. The decision underscored the necessity of detailed rules governing facial recognition measures and the imperative for robust safeguards against potential misuse and arbitrariness.

The court emphasized the implications of using such invasive technology, stating it could create a chilling effect on rights to freedom of expression and assembly. The court highlighted the importance of the right to respect for private life, as delineated in Article 8, and the freedom of expression, as set out in Article 10. In its judgment, the court established that the State’s interference with Glukhin’s rights did not align with a “pressing social need” and thus was not justified.

This case serves as a stark reminder of the inherent risks and challenges associated with biometric data, particularly when handled carelessly or without adequate justification.

b. Deciphering the Turkish Data Protection Board’s Verdict on Biometric Data

The Turkish Data Protection Board, in its decision under reference number 2022/662, made a crucial determination concerning the collection and processing of biometric data, specifically focusing on hand geometry.

i. Background of the Decision:

The decision came into the spotlight due to a complaint lodged by an individual, asserting that a private company had collected their hand geometry data without obtaining explicit consent. The main contention was that such an act was not only invasive but also contravened the principles enshrined in the Personal Data Protection Law (PDPL).

ii. Board’s Determination Regarding the Use of Biometric Data:

After thorough review and deliberation, the Board sided with the complainant’s concerns. It was unequivocally established that the collection of hand geometry data, even if intended for security or authentication reasons, is categorized under biometric data. This categorization mandates the acquisition of explicit consent from the data subject prior to any data collection or processing. The private company in question was deemed to be in breach of the PDPL, and was accordingly sanctioned with a 100.000 TL administrative fine.

iii. Implications of the Decision:

This resolution by the Board serves as a reminder of the intricate nature of biometric data and the stringent safeguards surrounding its collection and processing. The decision higlights the pivotal role of informed consent and stands as a cautionary tale for organizations to meticulously align their data processing practices with the prescribed legal mandates.

Beyond the immediate implications, the Board’s pronouncement sets a clear precedent for future cases and disputes surrounding biometric data. The decision elucidates the definition and scope of what is encompassed within biometric data, fortifying the rights of data subjects in the digital epoch. It beckons companies, both domestic and international operating in Turkey, to revisit and reassess their data collection methods, ensuring they are in strict congruence with the PDPL and other associated regulations.

VII. Concluding Thoughts on Biometric Data in Turkey

Turkey’s journey in the realm of biometric data protection is a dynamic one. With a robust legal framework in the PDPL, the country has set clear boundaries on what’s permissible and what’s not. From defining personal and biometric data to highlighting the rights and obligations of stakeholders, the law covers it all.

Real-world applications of biometrics in sectors like health, technology, and security show its growing importance. However, with international cases like GLUKHIN v. Russia ringing alarm bells, it’s evident that there’s no room for complacency.

Turkey’s Data Protection Board’s decision further cements the country’s stance on this matter, ensuring that biometric data processing aligns with the best practices and respects individual rights.

For entities, especially those in the private sector, it’s crucial to stay updated, comply with the regulations, and prioritize data protection. The landscape might be intricate, but with awareness and adherence, navigating it becomes less daunting.

health-tourism-in-turkey

HEALTH TOURISM IN TURKEY

A Guide for New Investors from Av. Ali Yurtsever

1. INTRODUCTION – HEALTH TOURISM IN TURKEY

Turkey has been a leading force in medical tourism market around the world for some time now. Although the market did take an initial hit with the emergence of Covid-19, it quickly recovered to pre-pandemic numbers once the travel restrictions were lifted. And since then, the number of foreign patients seeking medical and healthcare services in Turkish health institutions and doctors has steadily increased. Total number of foreign patients seeking healthcare services was approximately 338.000 in 2020. This number increased to 624.444 in 2021, whereas the first half of 2022 alone saw a total of 586.754 visitors from foreign countries seeking healthcare services.

The main forces driving these numbers and allowing Turkey to become a leader in global markets in health tourism services, are affordability and safety. Turkey offers cheaper healthcare services than most other countries with developed healthcare systems, which allows patients to seek affordable healthcare with a good quality of service. As for safety, Turkey took several steps to ensure that health tourism services are properly regulated with rigorous oversight from public officials, which ultimately allows patients to trust the health tourism service providers they deal with.

This, in return, means the barrier for initial entry into health tourism market in Turkey is slightly higher, since a new business will need to satisfy the criteria and obtain the relevant licenses as required by the state in order to legally conduct health tourism services. 

2. REQUIREMENTS FOR HEALTH TOURISM SERVICES

Medical services and health tourism related issues are tightly regulated under a set of legislative frameworks, starting with the main law text, the Law on the Method of Execution of Medicine and Medical Sciences No. 1219 (Medical Law), the Law on Health Care Services No. 3359 (Healthcare Law), and their secondary regulations and communiques. According to this framework, the institutions, entities and persons authorized to provide healthcare and patient care services (including health tourism) are strictly controlled and are mainly subject to licenses to be issued by the Ministry of Health in Turkey. 

According to the Regulation Regarding International Medical Tourism and Tourist Health (Health Regulation), agencies acting as intermediary health tourism operators will need to submit two separate applications for two separate licenses to two separate ministries, first a Group A Tourism Agency License obtained from TURSAB, and then a Medical Tourism Intermediary Agency License obtained from the Ministry of Health. Both of these licenses come with their own sets own criteria and requirements, which new businesses must adhere to in order to obtain them. 

a) Group A Tourism License

Article 5 of the Health Regulation sets forth that any intermediary agency operating as a health tourism agency will need to obtain a license from the Ministry of Health (health tourism license). However, in order to obtain this health tourism license, the applicant companies need to satisfy the requirements noted in the annex 2 and 3 of this Regulation. One of the requirements (and possibly the most important one), is to obtain a Group A tourism agency license (tourism license).

Tourism agencies, and tourism agency licenses, are regulated with the Law on Tourism Agencies and Tourism Agency Associations No. 1618 (Tourism Law) and the Tourism Agencies Regulation (Tourism Regulation). To obtain a Group A Tourism License, the investor will first need to establish a capital company (please refer to our article on Capital Investments in Turkey for more details). Special clauses need to be included within the company’s articles of association, during the incorporation stage. As such, it is highly advised that investors seek professional assistance. 

Once the company is established, an application needs to be made to the Ministry of Culture and Tourism for the reservation of a tourism agency title. Proper selection of the agency title will be important to avoid unnecessary time consumption during the approval process. Once this application is approved by the Ministry and the agency title is reserved, a separate application will be made to TURSAB to obtain the Group A Tourism License. 

It should be noted here that this Group A Tourism License application has a separate set of requirements and criteria that the applicants will need to satisfy. These include having a specific provision in the company AoA, collection and submission of proper company documents, having a proper office space that meets the criteria and employing personnel that meets the criteria noted in the Regulation.

b) Health Tourism Certificate

Once the Tourism License is obtained, the company will need to proceed with the application for a Medical License (Health Tourism Certificate) to the Ministry of Health. These applications are to be submitted to the relevant Provincial Directorate of Health where the company is located and are subject to a separate set of requirements. These requirements include (but are not limited to) signed protocols with different licensed medical facilities, infrastructure for a call center and employment of qualified personnel. 

Following the initial application, the Ministry will inspect the company, office space and declared employees, to check and verify that the office space is suitable, the employees all have the necessary qualifications and are employed by the company, and that the company has the necessary technological infrastructure as well as the necessary equipment (phones, internet, computers etc.) to efficiently handle applications from potential tourists.

3. ISSUES WITH PERSONAL DATA PROCESSING & COMPLIANCE

Apart from the standard licenses a company need to have to provide health tourism services in Turkey, any business that will operate in this field will also need to take utmost care in the handling of personal data of patients who purchase services through them. This is especially important as any health tourism company will be effectively handling and processing health data of patients, which is classified as sensitive personal data as per the Law on Personal Data Processing (LPDP). For details on personal data processing in Turkey, please refer to our articles on Principles for Lawful Personal Data Processing and Personal Data Protection in Turkey.

This classification of health data is equally important for determining whether the data processor will be required to register to the Data Controllers’ Registry (VERBIS). Data Controllers’ Registry or VERBIS is a publicly available database kept by the Data Protection Board (the “Board”), the decision-making body of the Turkish Data Protection Authority (the “DPA”). Unless exempt from the requirement, all data controllers (individuals and legal entities) who process personal data in Turkey must register with VERBIS. 

Accordingly, the following data controllers will be required to register to VERBIS:

  • Legal entities with more than 50 employees annually or whose annual total financial statement exceeds TL 25,000,000.
  • Legal entities that have less than 50 employees annually and whose annual total financial statement is less than TL 25,000,000 but whose main business is processing sensitive personal data (e.g. ethnic origin, political opinion, membership of associations, information relating to health).

According to the criteria above, a health tourism agency will be required to complete its registration into the VERBIS system, since it will be effectively processing sensitive personal data. It is therefore crucial that the investors ensure that the company is in full compliance with data protection regulation (including VERBIS registration) to avoid potential penalties and fines.  

4. CONCLUSION

As you can see, although Turkey is a booming market as far as health tourism services are considered, potential investors should thread carefully when planning their entry into the market. The legislative requirements, coupled with the requirements for different licenses and compliance to different legislative issues such as data protection rules, can result in huge loss of time and extra costs to investors if the investment is not properly planned from the start. To avoid such problems and to ensure the cost for initial entry remains low, it is advised that investors seek professional help and assistance when setting up their health tourism services in Turkey. 

8-principles-for-lawful-personal-data-processing

8 Principles for Lawful Personal Data Processing in Turkey

Av. Ali Yurtsever L.L.M

Personal Data Processing & LPDP

The legal landscape surrounding digital data has been steadily changing and evolving over the years. The overall pace of this change increased with Europe’s implementation of the GDPR, which pushed other countries to adapt to this new set of rules and regulations. To keep up with the international legislative changes, Turkey also enacted the Law on Personal Data Protection No. 6698 (‘the LPDP’) and imposed new rules and obligations (similar to Directive 95/46/EC) for personal data processing in Turkey. (Please refer to our previous article “Personal Data Protection in Turkey” for an overview of LPDP provisions).

The implementation of the LPDP also meant additional compliance requirements and liabilities for businesses that control and/or otherwise process personal data. However, attaining full compliance to LPDP and the Data Protection Authority’s (DPA) decisions is no easy task, as businesses are required to implement various measures, from drafting new documents relating to the personal data processing to additional administrative and technical measures as outlined by the DPA. To have a better understanding of the LPDP and its potential liabilities, please refer to our previous article “Data Protection in Turkey” (also available here).

Although it may seem complex, one of the most important steps in attaining full compliance with the LPDP is to fully understand when and where businesses, data controllers, and data processors can lawfully conduct personal data processing activities. Accordingly, Article 5 of the LPDP outlines 8 principles (also known as general conditions) for lawful data processing:

personal-data-processing

General Conditions for Lawful Personal Data Processing

As illustrated in the above graphic, the LPDP allows for the personal data processing if; (i) the data owner gives explicit consent, (ii) it is clearly provided for within the legislation, (iii) necessary to protect the legitimate interests of the data controller, (iv) mandatory for the establishment, exercise or protection of a right, (v) is disclosed to the public by the relevant data owner, (vi) relevant for the signing, performance, and conclusion of a contract, (vii) necessary for the protection of life and/or physical integrity of the data owner, in situations where it is no possible to obtain explicit consent, or (viii) mandatory for the data controller to perform its legal obligations.

The main reason for the LPDP providing numerous legal bases for data processing is to prevent these personal data protection rules from hindering the day-to-day B2C commercial activities. Especially the bases concerning legitimate interest, the exercise of a right, and the performance of a contract are specifically designed to enable the data controllers/processors to process their customers’ data required for the performance of the specific contract signed between them.

However, this does not mean that data controllers/processors can process any data they like without performing the necessary checks and review, as certain conditions noted above are mutually exclusive, meaning one cannot be present if another legal basis is applicable to that specific personal data processing.

Accordingly, one of the main issues to note here is that if the legality of the data processing is not based on explicit consent but is rather based on one of the remaining 7 conditions noted above, data controllers should refrain from obtaining additional consent.

Issues With Obtaining Guarantee Consents

One of the most common mistakes data controllers and processors make is that they try to obtain consent from the relevant data owners, event when one or more of the other data processing conditions are met. Obtaining separate consent from a customer for personal data that is required to execute a contract can be a good example here.

These are called “Guarantee Consents”, as they are generally obtained because data controllers want to guarantee that they are protected against LPDP sanctions. However, these guarantee consents do more harm than good, as the DPA does not accept such guarantee consent clauses and explicitly states that if one of the other 7 general conditions (other than consent) is applicable for the processing of personal data, then the data controllers should not obtain separate consent for that processing.

The DPA argues that a (guarantee) consent clause will lead the data owner to believe that they can withdraw the consent at any time and therefore demand the data controller to stop processing. However, in cases where one of the other 7 conditions applies, this false impression caused by the consent clause misleads the data owners, as the data controller can (and in some cases is required to) continue to process the data even if the data owner withdraws the consent, based on one or more of the 7 other general conditions, as applicable to the relevant data.

These “guarantee” consents can even lead to administrative measures and fines issued by the DPA, as the DPA considers these types of consents as violations of the LPDP principles [for a detailed review of LPDP administrative fines, please refer to our previous article “How to Appeal Against Administrative Fines Imposed by the Turkish Data Protection Authority”, (also available here)].

It is, therefore, imperative that businesses and data controllers conduct a full assessment of the personal data they are going to process to accurately determine whether one or more of the above-mentioned 7 conditions (except for consent) are applicable to that specific data set. If yes, they should refrain from obtaining additional consent from data owners. Whereas if none of the 7 conditions apply to the specific data set, then explicit consents will be required to lawfully process that data.

personal-data-protection-in-turkey

Personal Data Protection in Turkey

Av. Ali Yurtsever L.L.M

The Law on Personal Data Protection

With the implementation of the Law on Personal Data Protection No. 6698 (‘the LPDP’), new rules and obligations were imposed on data controllers and data processors. The LPDP further stipulated serious monetary fines and prison sentences to those who violate these obligations. Unfortunately, most data controllers/processors in Turkey failed to grasp the potential liabilities arising from the LPDP provisions. One of the more common mistakes among data controllers/processors is that they tend to believe the LPDP and the personal data protection provisions are only applicable to those required to register to the Data Controllers Registry (VERBIS).

This assumption is, of course, false as the VERBIS registration requirement is a separate requirement/obligation and is not tied to the applicability of the LPDP provisions. Therefore, it is extremely important for all companies (or individuals) that process personal data to comply with the rules and procedures set forth at the LPDP, independent from the VERBIS registration obligation.

Fact Check – Does the LPDP Apply to Your Business?

One of the main issues with the applicability of the LPDP is that the companies, shareholders, and/or individuals wrongfully interpret the terms noted within the legislation. The most common mistakes concern the terms “data processing” and “data controller”, as most company representatives mistakenly think that storing and processing of data are two different concepts and since they only store personal data they cannot be deemed as data controllers, which in turn leads to the company not taking any action with regards to compliance with LPDP and personal data protection.

Therefore, it is crucial that the shareholders and company representatives fully understand the concepts/terms of personal data, data processing, the data controller, and data processor to accurately determine which LPDP/personal data protection provisions are applicable to them.

a. Personal Data is defined in a very broad manner within the LPDP. As per this definition personal data means “all information belonging to a natural person whose identity is or can be determined”. With this broad definition, any and all information that may allow the data holder to identify a specific person shall be deemed as personal data. These may include ID details, name, surname, date of birth, phone numbers, CV, photos, income, expense preferences, address, number of children, e-mail and IP addresses, hobbies, location information, etc. Accordingly, the general rule is, if any snippet of information can allow the identification of a specific person, that information is deemed as personal data.

b. Personal Data Processing is further defined at the LPDP as “any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means”. Therefore, even the mere act of storing any one of the above-mentioned personal shall be deemed as an act of processing, even if the relevant data controller does not use the data in any meaningful or impactful way.

c. Data Controller is defined as “the natural or legal person who determines the purpose and means of processing personal data and is responsible for establishing and managing the data registry system”. To illustrate, if your company processes any personal data such as a customer’s e-mail address, phone number, home address, name, surname, or birthdate, either in a physical medium, digitally in a server, or via third-party service providers, then your company shall be deemed as a data controller as per the LPDP and you will need to comply with personal data protection rules.

d. Data Processor is defined as “the natural or legal person who processes personal data on behalf of the controller upon his authorization”. In this context, if for example, the finances of your company and its tax returns are handled by a third-party accountant, either a natural person or a third party company, this third party accountant processing these accounting documents (such as invoices which may contain personal data) shall be deemed as data processors.

e. Data Registry System is defined as, “the registry system which the personal data is registered into through being structured according to certain criteria”. Therefore, all systems designed to store and otherwise process data shall be deemed as a data registry system.

LPDP Requirements and Potential Liabilities

As noted above, any person and/or a legal entity that can be classified either as a personal data controller and/or a personal data processor will be required to adhere to the rules set forth by the LPDP when processing personal data. These terms are collectively known as general conditions for data processing, which are analyzed in detail in a separate article. Accordingly, most data processing performed in adherence to these general conditions will be deemed to be in compliance, provided the personal data controller/processor fully complies with the LPDP and its secondary regulations.

Conversely, failure to abide by the rules and conditions set forth by the LPDP may result in the application of a number of restrictions and fines against the personal data controller/processor. These can range from restrictive measures to administrative fines up to TRY 1.000.000.- (even higher fines may be applicable depending on the violation).

The determination of the administrative fines is left to the discretion of the personal Data Protection Authority (DPA), as Article 18 of the LPPD only provides a lower and upper limit for administrative fines that can be issued. Accordingly, the DPA is authorized to impose administrative sanctions on those who violate the obligations set forth at the LPPD as per Article 22 of the LPDP.

This broad discretionary power of the DPA has caused some issues in certain administrative measures applied to different data controllers/processors in the past, as some have argued that the DPA has abused its authority by issuing fines from the upper limit without providing a just cause to do so (some have even filed lawsuits against the imposed fines). To better understand these issues surrounding the administrative fines issued by the LPDP, please refer to our previous article titled “Appeals Against Administrative Fines Imposed by the Turkish Data Protection Authority” (also available here).

Conclusion

To be fair, the rules and regulations governing data processing can seem complex, especially to foreign entities trying to operate within the Turkish market. The main source of confusion is, of course, the LPDP text, and the fact that data controllers and data processors also need to take DPA decisions into account when implementing new internal data processing rules, which can be challenging to foreigners as the DPA decisions are generally not available in any language other than Turkish.

Furthermore, this personal data protection legislation is still quite new and is therefore continuously evolving and changing mainly with new DPA decisions and fines. This evolving nature of the compliance mechanisms also presents significant challenges and issues if the data controllers/processors opt to use standardized legal text to ensure compliance with these rules, as these standardized texts are usually heavily outdated and contain wrong or in some cases outright insufficient wordings and mechanisms.

It is therefore imperative for data controllers and/or data processors to consult an expert to ensure that their personal data protection compliance mechanisms are implemented properly to avoid any unnecessary and avoidable fines in the future.

appeals-against-administrative-fines

Appeals Against Administrative Fines

How to Appeal Against Administrative Fines Imposed by the Turkish Data Protection Authority

Av. Ali Yurtsever L.L.M

With the implementation of the Law on the Protection of Personal Data No. 6698 (LPPD) and its secondary regulations, the Data Protection Authority (DPA), tasked with monitoring violations of LPPD obligations, have started to impose administrative fines to persons and/or companies violating their obligations set forth at the LPPD. Although Article 18 of the LPPD does state the monetary fines applicable to such violations, it did so by determining a lower and upper limit for administrative fines. This not an uncommon practice as most administrative fines stated in other legislation in Turkey are determined this way, giving discretionary powers to the relevant authority imposing the fines (although there are also fixed administrative fines determined in other legislation). However, difference between the lower and upper limits set forth by the LPPD is high enough (the fines can range from TRY5.000 up to TRY1.000.000 depending on the type of violation) to cause arbitrary treatment of certain data controllers.

Legal Standing of the Administrative Fines Imposed by the DPA

According to Article 22 of the LPPD, the DPA is authorized to impose administrative sanctions to those who violate the obligations set forth at the LPPD. Whereas the sanctions applicable to such violations is noted at Article 18 of the LPPD, titled “Misdemeanors”. Although the sanctions are listed at this article, there are no provisions that includes clauses regarding the legal standing of these sanctions and the procedures for legal remedies and/or objections against such.

Instead, the legal standing of these sanctions is noted in the preamble of the LPPD. Accordingly, the preamble states that these sanctions are deemed as misdemeanors and that the DPA shall apply the conditions mentioned at Article 17 of the Misdemeanor Law No. 5326 (Misdemeanor Law), when issuing a sanction. Therefore, the administrative fines noted at the LPPD should be evaluated within the context of the Misdemeanor Law.

According to this Article 17 of the Misdemeanor Law, administrative fines can be determined either as a fixed (pre-determined) amount or by providing a lower and upper limit for the fine, which gives discretionary powers to the relevant authority to decide on the exact amount of the administrative fine to be imposed to a specific case. In this respect, the provision included within the LPPD does not violate or otherwise contradict with the Misdemeanor law, as it simply provides lower and upper limits, and leaves the determination of the actual fine up to the discretion of the DPA.

However, Article 17 also notes that, in cases where the administrative fines are determined with lower and upper limits (and therefore are not fixed), actual administrative fine amounts to be imposed should be determined by taking into account the specifics of each case, the nature of the infringement, as well as the degree of fault and the economic conditions of the perpetrator. Since the LPPD provisions regarding administrative fines are to be interpreted within the context of the Misdemeanor Law, any administrative fine to be imposed should be proportional with the nature of the infringement, as well as the degree of fault and the economic conditions of the perpetrator (in this case the data controller or processor).

Discretionary Powers of the DPA to Impose Administrative Fines

In light of the above information concerning the proportionality principle, it is important to review and consider the administrative fine amounts previously imposed by the DPA within the context of the LPPD. We already discussed above that the legislation provides for a high margin between the lower and upper limits for administrative fines, which was an intentional decision made during the drafting of the LPPD.

The reasoning for such high margins is to provide the DPA with discretionary powers in determining the appropriate penalty amount depending on the specifics of each infringement, and although the LPPD does not include specific provisions setting guidelines for determining the penalty amounts, the preamble designates that the DPA shall be required to consider the provisions of the Misdemeanor Law when determining these penalty amounts.

When previous DPA decisions are reviewed, it becomes clear that in some decisions, the DPA made arbitrary and controversial decisions and imposed the maximum administrative fine available to data controllers or processors without considering their economic conditions.

In these cases, it can be argued that the DPA failed to take the provisions of the Misdemeanor Law in account, and did not apply the proportionality principle to determine a fair penalty amount, which lead to an exorbitant administrative fine imposed from the upper limit provided by the LPPD. Another important aspect to note here is that the most of these decisions also lack a comprehensive justification for imposing a penalty from the upper limit.

One of the main reasons for such arbitrary DPA decisions is the lack of clear provisions stating the rules and procedures for determining penalty amounts and the vagueness within the LPPD and its secondary regulations. The DPA does not have a clear guideline set forth for determining the penalty amounts, but is rather only required to observe the general rules for administrative fines set forth at the Misdemeanor Law, which gives the DPA a carte blanche to determine arbitrary penalty amounts as it deems fit.

Although the case law concerning the LPPD provisions is yet to be established by the Turkish courts, there are other legal precedents established by the Council of State, concerning administrative fines imposed based on different legislation.

According to one precedent of the Council of State, the competent authority tasked with imposing administrative fines should determine the penalty amounts in accordance with the provisions of the Misdemeanor Law and should therefore take into account the nature of the infringement as well as the economic condition of the perpetrator, even though the relevant legislation provides discretionary powers to determine the penalty amount to the relevant authority.

The Constitutional Court also established a similar precedent and decided that the relevant authority does not have an unlimited discretionary power to determine the administrative fine amount and shall always be limited by the law, and should therefore always take into account the specifics of the case and the economic conditions of the perpetrator.

Appeals Against DPA Sanctions

As noted above, the LPPD preamble states that any administrative fine imposed based on Article 18 shall be subject to the Misdemeanor Law provisions. Accordingly, the rules and procedures of legal objections against such administrative sanctions shall also be determined in accordance with the same Misdemeanor Law.

Article 27 of the Misdemeanor Law sets forth that appeals against administrative sanctions can be filed before the competent criminal judicature of peace within 15 days from the receipt of the relevant sanction and/or administrative fine. Therefore, in cases where the data controllers / processors are fined by the DPA for infringements of the LPPD, the relevant controllers or processors may appeal this decision to the competent criminal judicature of peace within 15 days from the receipt and may request the cancellation or re-evaluation of the fines.

Although court precedents regarding these LPPD issues are yet to be established, the data controllers and/or processors fined by the DPA have started to appeal these decisions and some of these cases have been already reviewed by the relevant criminal judicatures of peace.

Accordingly, some of the sanction decisions passed on the courts were found to be unfair as the DPA did not consider the nature of the infringements and the economic conditions of the controllers / processors, and also failed to adequately justify the reasoning for imposing fines from the upper limit.

Accordingly, one recent criminal judicature of peace decision overturned a DPA decision, which imposed an exorbitant amount of administrative fine to a data controller, and decreased the administrative fine amount significantly, stating that the DPA failed to justify and provide compelling reasons for imposing a fine from the upper limit.

Although there are many cases still pending before the courts and the case law is yet to be established by higher courts, the recent court decisions suggest that, in some cases, the DPA is in fact imposing arbitrary and exorbitant administrative fines to data controller / processors, without considering their economic conditions.

Considering that the DPA is starting to extend its reach within the market to monitor a wider range of data controllers / processors, these arbitrary practices by the DPA will continue unless the LPPD and its secondary regulations are amended to include specific criteria for determining administrative fines. Considering the recent court decisions, data controllers / processors may appeal against administrative fines and request a re-evaluation, where DPA issued arbitrary penalties without justification.

commercial-electronic-messages

Commercial Electronic Messages

Commercial Electronic Messages and Message Management System Registration Process

Av. Ali Yurtsever L.L.M

With the entry into force of the Law No. 6563 on the Regulation of Electronic Commerce (Law), the transmission of commercial electronic messages used by many companies for promotional and advertising purposes to users and customers is subject to certain terms and conditions. Following the recent changes made in the Regulation on Commercial Communication and Commercial Electronic Messages (Regulation), individuals and institutions (service providers) who want to send commercial electronic messages to their users and customers are obliged to register in the Message Management System ( İYS ). It is very important for service providers to pay the utmost attention to these obligations so that they do not face heavy administrative sanctions.

Commercial Electronic Message Definition and Obtaining Approval

 Commercial electronic message is defined in Article 2 of the Law and Article 4 of the Regulation. In accordance with both articles, commercial electronic message is “ a message containing data, audio and video content sent for commercial purposes and carried out in electronic environment using means such as telephone, call centers, fax, automatic dialing machines, smart voice recording systems, e-mail, short message service.defined as ”. 

Although a general definition is made here, institutions and organizations that want to send messages to their customers cannot be sure about which messages will be considered commercially. Pursuant to Article 6 of the Law, since commercial electronic messages can only be sent in the presence of the recipients’ prior consent, it is very important to determine which messages will be considered as commercial electronic messages.

In order to eliminate this confusion, with the amendment made in Article 5 of the Regulation, it has been clearly determined which messages will be considered as commercial electronic messages. Pursuant to this Article 5, any message sent to the electronic communication addresses of the recipients in order to promote and market their goods and services, to market their business or to increase their recognition with content such as congratulations and wishes will be considered as commercial electronic messages and therefore cannot be sent without the prior consent of the recipient. .

As we mentioned above, in accordance with Article 6 of the Law, prior approval of the relevant recipients is required in order for commercial electronic messages to be forwarded to the recipients. It is possible to obtain this consent in writing or by any means of electronic communication. 

Another point to be noted here is that the provisions of this Law and the Law on the Protection of Personal Data No. 6698 (KVKK) conflict in terms of approval to be obtained. This contradiction has become even more evident with the latest decisions of the Personal Data Protection Authority. Therefore, when obtaining communication approval for commercial electronic messages, it is important to consider the express consent provisions specified in the provisions of the KVKK and to obtain the approval/consent to be obtained in accordance with the provisions of both laws.

Message Management System and Registration Obligation

Although the provisions of the Law and the Regulation and the procedures and principles regarding the sending of commercial electronic messages are clearly defined, it is observed that there are problems in practice such as the recipients of the messages cannot follow which persons and institutions they have given their approval under and under what conditions, and the message senders continue to send messages to the recipients who do not have permission.

The Turkish Commercial Message Management System (IYS) was introduced with the amendment made in the Regulation in order to eliminate these problems and to enter all the approvals received from the recipients into a national integrated system, to control the approvals through this system and to send messages accordingly .

IYS can be summarized as a national approval system. With this system, it is aimed that service providers who want to send commercial electronic messages can get approval from the recipients through IYS, the recipients can use their right of cancellation and refusal regarding the approvals they have given before, and they can also submit their complaints about the sendings made in violation of the legislation through this system.

In this context, in order for the system to be national and integrated, and for all recipients to check their approvals over the system, with the amendment made in Article 5 of the Regulation, service providers wishing to send commercial electronic messages have been required to register with the IYS. Accordingly, service providers are obliged to register with the IYS and upload the approvals they receive from the buyers to this system. Pursuant to Article 5/3 of the Regulation, it is prohibited to send commercial electronic messages to recipients who do not have approval on the Message Management System.

Persons and Institutions Required to Register in the Message Management System

 The phrase “service providers” in the regulation causes a misunderstanding that some real and legal persons do not have to be registered in this IYS system. Because, the Regulation defines service providers as “ real or legal persons engaged in electronic commerce activities ”. Based on this definition, although it can be concluded that only natural and legal persons engaged in electronic commerce activities are obliged to register, again in Article 5/2 of the Regulation. Article requires all natural and legal persons who want to send commercial electronic messages to register with the İYS.

Therefore, all real persons who engage in commercial activities in any way and/or want to send commercial electronic messages to the electronic communication addresses of the buyers in order to promote their own brand and/or business and/or advertise their services/products or to increase their recognition with content such as celebrations and wishes and legal entities are obliged to register with this Message Management System and upload all the approvals they have previously received from the recipients to the IYS. 

All persons and institutions that send commercial electronic messages to recipients who do not comply with these obligations and do not register with the IYS and/or do not have approval in the system may face administrative sanctions under both the Law on the Regulation of Electronic Commerce and the KVKK.

The deadline for service providers, who are obliged to register to the IYS, to register the system was determined as 31.05.2020. However, due to the negative impact of the Covid-19 epidemic on daily life and disruptions in business processes in this process, this deadline has been postponed to 31.08.2020. Therefore, service providers are required to complete their registration to the Message Management System and upload existing recipient approvals to the system by 31.08.2020 at the latest .

Validity of Approvals Received Before Registration

 As we mentioned above, the communication approvals obtained from the recipients in accordance with the provisions of the Law and the Regulation before registration in the Message Management System must also be uploaded to the IYS by 31.08.2020 at the latest. Following the uploading of these approvals to the system, the buyers will be able to check all the approvals they have given over the system until 1 December 2020 and cancel the approvals they wish. 

It is accepted that if the approvals whose system has been installed until 31.08.2020 are not canceled by the buyers until 1 December 2020, these approvals will also be valid for the new system. Therefore, the approvals obtained before registration are submitted to the İYS on 31.08.

cross-border-data-transfers-in-turkey

Cross-Border Data Transfers in Turkey & Effects of the Data Protection Board’s Amazon Turkey Decision

Av. Ali Yurtsever L.L.M

Data Protection Board recently issued a new decision and fined Amazon Turkey 1.100.000 TRL for violations of data protection and e-commerce legislation, and for unlawful cross-border data transfers especially for data transfers to its overseas affiliates. Moving forward, the decision will have serious ramifications regarding data transfers in Turkey, and in order to better understand these consequences, we need to first understand the background that lead to such decision.

 Personal Data Protection in Turkey

 In a globalized economy where technology companies dominate and control much of the content marketing and where data is seen as the new gold, restricting and monitoring cross-border data transfers is becoming ever-more important, which is also highlighted in the Data Protection Board’s (DPB) Amazon Turkey Decision.  In this respect, Turkey is taking a similar stance regarding data protection as Europe, by implanting the Law on the Protection of Personal Data No. 6698 (LPPD), which is essentially the Turkish version of the General Data Protection Regulation (GDPR).

Transfer of Personal Data to Third Parties

Personal data transfers to third parties are quite restrictively regulated under the LPPD (similar to provisions in the GDPR). Article 5 of the LPPD clearly states that data controllers cannot transfer personal data to third parties without the explicit consent of the data owner except for the circumstances set forth at Article 5/2 and 6/3. Article 9 further states that cross-border data transfers are forbidden unless the data owner consents explicitly to such cross-border data transfers. Article 9/2 provides an exception to this rule and allows for cross-border data transfers without the data owners explicit consent in cases where circumstances set forth at Articles 5/2 and 6/3 are applicable and if (i) “sufficient protection is provided in the foreign country where the data is to be transferred” or (ii) “the controllers in Turkey and in the related foreign country guarantee a sufficient protection in writing and the Board has authorized such transfer, where sufficient protection is not provided”.

Data Transfers and Exceptions to Explicit Consent

 As noted above, the general rule for data transfers, either domestic or cross-border, is to obtain the prior explicit consent of the data owner. However, the LPPD does provide certain exemptions to this requirement both for personal data and for personal data of special nature, set forth at article 5/2 and 6/3 respectively. According to Article 5/2, personal data can be processed and transferred to third parties without the explicit consent of the data owner if:

  1. Provided/required by the law,
  2. Required for the protection of life or physical integrity of a person who is not bodily able to provide consent,
  3. Required for the conclusion, fulfillment or procurement of services noted in a contract,
  4. Required for the data controller to perform its legal duties,
  5. The data is disclosed to the public by the data owner,
  6. Data is deemed as mandatory for the establishment exercise or protection of any right, or
  7. Mandatory for the legitimate interests of the controller, provided that it does not violate the fundamental rights and freedoms of the data owner.

 Article 6/3 further states that personal data of special nature, excluding data relating to health and sexual life, can be processed, and transferred to third parties without the explicit consent of the data owner if provided for by the laws.

 Cross-Border Data Transfers and the Problem of Sufficient Protection

These provisions that set forth exceptions to the explicit consent rule for cross-border data transfers are quite clear, as Article 9/2 states that cross-border data transfers can be executed without the explicit consent of the data owner if sufficient protection is provided in the foreign country where the data is to be transferred. Taking into account that this LPPD is almost a direct translation of the GDPR, it is reasonable to assume that all cross-border data transfers into one or more of the countries where the GDPR is applicable will be covered by this provision and therefore will be exempt from the explicit consent requirement.

Unfortunately, this is not the case. The problem here arises from subparagraph 3 of the same Article 9, which states that the DPB shall determine and announce the countries where sufficient level of protection is provided. The DPB is yet to announce such list, which means that the exemption provided for at Article 9/2/a is not yet applicable to any cross-border data transfers, including to countries where the GDPR is applicable.

Summary of Amazon Turkey Decision on Cross-Border Data Transfers

 Complaints against Amazon Turkey

As noted at the beginning of this article, following a complaint filed by an Amazon Turkey user regarding unlawful data processing and transfer, Data Protection Board fined Amazon Turkey 1.100.000 TRL for unlawful cross-border data transfers to its overseas affiliates and for non-compliance with data protection and e-commerce laws. One of the major claims stated in this compliant was the fact that Amazon Turkey included the phrase “We may transfer your personal data to the European Union and the United States in order to store and process your personal information within the context of the purposes set forth in this Privacy Notice”, which, according to the complaint, violated the obligations set forth in LPPD due to the fact that Amazon Turkey did not obtain the explicit consent of the data owner for such international transfers, but rather only notified that it can transfer the data overseas.

DPB’s Amazon Turkey Decision Regarding Cross-Border Data Transfers

Following the complaint, the DPB launched an investigation into Amazon Turkey and determined that it did not, in fact, obtain an explicit consent from the data owners for cross-border data transfers, but rather provided the data owners the option to opt out or choose not to share their data with third parties. This opt-out mechanism was found to be in violation of the LPPD, as the law clearly requires an explicit consent from data owners for cross-border data transfers, and therefore requires that the data owners explicitly “opt-in” to such transfers rather than assuming the data owners opted-in to this by default and then providing them an opt-out option.

Since Amazon Turkey did not acquire prior explicit consent from the data owners, the only option for Amazon Turkey to lawfully conduct cross-border data transfers in Turkey was to claim that such transfers fell within the scope of the exemptions provided for in Article 9/2 LPPD.

However, as seen above, such exemptions only apply for cross-border data transfers if sufficient protection is provided in the foreign country where the data is to be transferred and the DPB is authorized to determine the countries with sufficient levels of protection as per Article 9/3. The issue here is, as also mentioned above, the DPB is yet to publish such an exempted countries list, and since that list is not yet made available, this exemption provided for countries with sufficient protections does not yet apply to any country, including EU countries where the GDPR is applicable.

Since Amazon Turkey cannot benefit from this “sufficient protection” exemption, that leaves the final exemption provided in Article 9/3, where cross-border data transfers can be conducted without prior explicit consent to countries without sufficient protection, if the foreign data controllers in Turkey and in the related foreign country gives letters of guarantee to the DPB in writing and the Board approves such transfer. It should be noted here that Amazon did actually submit a guarantee to the Board in order to benefit from such exemption.

However, at the time of this complaint and the decision, Amazon’s guarantee letter and exemption application was still pending before the DPB, awaiting the Board’s final decision and approval. Article 9/3 clearly states that this exemption will only be applicable if a guarantee letter is provided  AND the DPB approves transfers, and since DPB never approved Amazon Turkey’s exemption application, the DPB decided that such cross-border data transfers executed by Amazon Turkey violated the provisions of the LPPD.

Moving Forward: Effects of the Amazon Turkey Decision on Cross-Border Data Transfers

The decision to fine Amazon Turkey was a highly controversial decision by the DPB. It was controversial because Amazon Turkey was transferring personal data to EU countries, which should have been deemed as countries with sufficient protection since those countries are also under the regulation of the GDPR, and because Amazon Turkey had already provided the Board with the necessary guarantee letters to benefit from the second exemption provided for in Article 9/3.

Although we understand where the arguments against this decision are coming from, we also believe that the law is quite clear and transparent about exemptions. The LPPD provisions clearly state that exemptions for cross-border data transfers shall only be applicable if the country where the data is transferred has sufficient levels of protection (to be determined by the Board), or where sufficient protection is not available, a guarantee letter is provided and the transfer is approved by the Board.

Since the exempted countries list is not yet published by the Board, the only way to benefit from cross-border data transfer exemptions is to submit a guarantee letter to the Board and wait for the Board’s approval for transfers. Although Amazon did provide a guarantee letter, they did not wait for the application to be processed and for the Board’s approval and continued with cross-border data transfers without obtaining explicit consents from the data owners.

In this respect, the DPB have made its position abundantly clear; if data controllers want to conduct cross-border data transfers without obtaining explicit consents, they should either wait for the exempted countries list to be published, or submit a guarantee letter and wait for the Board’s approval. Otherwise, all data controllers are required by the LPPD to obtain explicit consent from data owners before conducting cross-border data transfers.

Load More