LAW ON THE PROTECTION OF PERSONAL DATA

“Law on Protection of Personal Data No.6698” was published and entered into force on April 7th, 2016 and it regulates detailed provisions on the procedures of personal data such as processing, transferring, destructing, and administrative fine for those who fails to follow these legal obligations.

Our team, in line with our domestic/foreign clients’ interests, provide support on compliance with the legislations, mainly Law on the Protection of Personal Data (Law) and GDPR (General Data Protection Regulation), preparing the necessary documents, modification on contracts, preparing an inventory and all manner of legal affairs/processes about personal data protection.

What is Personal Data?

Personal data is any information relating to a natural person who can be identified, directly or indirectly, by reference to an identifier such as “name, surname, birth date and place, phone number, curriculum vitae, photograph, records of image and sound, fingerprints, IP address, e-mail, hobbies, preferences, people contacted with, group memberships, family information, health information”.

Any information mentioned above received by employer from their employee, goods and service providers from their customers or associations/foundations from their members can be examples of personal data. Law also defines personal data such as natural person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and the biometric and genetic data as “Personal Data of Special Nature”, and prohibited to process the personal data of special nature, excluding those relating to health and sexual life, in the cases provided for by laws, without explicit consent of the data subject.

Personal data relating to health and sexual life may only be processed, without seeking explicit consent of the data subject, by any person or authorised public institutions and organizations that have confidentiality obligation, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing

What does Processing of Personal Data mean?

Processing of Personal  Data is, any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means. Conditions and exceptions for processing of personal data is regulated in Law. 

How does the Law define Controller and Processor?

Law used definitions for Controller and Processor separately. 

Controller: The natural or legal person who determines the purpose and means of processing personal data and is responsible for establishing and managing the data registry system. 

Processor: The natural or legal person who processes personal data on behalf of the controller upon his authorization. Data subject’s rights are regulated under Art.11 for persons who think their personal data is collected, processed against the law. 

What is Registry of Controllers (VERBIS)?

Registry that natural or legal persons who process personal data are obliged to enroll before proceeding with data processing is called “the Registry of Data Controllers (VERBIS)”. According to Art. 16, natural or legal persons who process personal data shall be obliged to enroll in the Registry of Data Controllers before proceeding with data processing. 

What is the deadline for registration on VERBIS? 

As of now, (unless the Turkish DPA’s Board extends the deadline) for legal entities which have less than 50 employees annually and whose annual total financial statement is less than TL 25,000,000 but whose main business is processing sensitive personal data, has to register on VERBIS before 30 September 2020, workplaces that have over 50 employees yearly, or have financial balance sheet over TL 25,000,000 (approx. USD 4,500,000) before 30 June 2020.

It is important to conduct legislation compliancy work in compliant with the new regulations, completing the process for VERBIS registration, preparing the necessary documents and keeping it up to date. In the contrary case, upon investigation by the Board through an application of relevant persons, the controller may face administrative fees. To avoid fees that may go up to 1.800.000 Turkish Liras, receiving legal support from a professional team and setting up a legal foundation is necessary.