Subject            : Amendments to the Law No. 6698 on the Protection of Personal Data (“KVKK  or the Law“) with the “Law Amending the Law of Criminal Procedure and Certain Laws” published in the Official Gazette dated March 12, 2024.

Date                : March 12, 2024

1.    INTRODUCTION

Law No. 7499 on Amendments to the Law of Criminal Procedure and Certain Laws was published in the Official Gazette dated March 12, 2024 and numbered 32487. This amendment introduced significant provisions in the KVKK that will have a great impact in practice.

Within the scope of the amendments to the LPPD, in order to meet the needs arising in practice, to respond to concrete problems experienced by data controllers, to resolve blocked transactions and to comply with the European Union General Data Protection Regulation (“GDPR”), the provisions of the LPPD currently in force regarding the processing of sensitive personal data (Article 6), data transfer abroad (Article 9), misdemeanors (Article 18) have been amended and a temporary article (Temporary Article 3) has been stipulated to create a transition period.

The Amendment envisages a two-stage transition. Accordingly, the first paragraph of Article 9, before it was amended by this Law, will continue to be applied until September 1, 2024 with the amended version of the article entering into force, and the remaining regulations will enter into force on June 1, 2024.

1. CHANGES IN THE KVKK

                    1.1. TERMS OF PROCESSING SPECIAL NATURE PERSONAL DATA

                    (Article 6)

Article 6 of the Law regulates the conditions for processing sensitive personal data. With the amendment, the provision that sensitive data cannot be processed without the explicit consent of the data subject has been repealed and amended with exceptions.

With the amendment, the processing of sensitive data has been prohibited in paragraph 3 of the Article, but extensive exceptions have been provided to this prohibition. Following the amendment, sensitive personal data may only be processed in the presence of one of the following conditions:

1. Explicit consent of the data subject,
2. Explicitly stipulated in the law,

• Processing is mandatory to protect the life or physical integrity of the data subject or of another natural person where the data subject cannot disclose their consent due to actual impossibility or whose consent is not legally valid

1. Processing of personal data made public, in accordance with the intention of the data subject,

1. Data processing is mandatory for the establishment, enforcement or protection of a right,

1. Processing by persons or authorized institutions and organizations under the obligation of confidentiality, for the protection of public health, preventive medicine,medical diagnosis, treatment and care services, and for the planning, management and financing of health

services,

• Processing is mandatory for the fulfillment of legal obligations in the field of employment, occupational health and safety, labor and social security or social services and social assistance
• Processing carried out by other non-profit organizations established for political, philosophical, religious or trade union purposes on condition that the processing relates solely to the members of the organization or to persons who are in regular contract with this organization.

In addition to the processing conditions, the Amendment also amends paragraph 3 of Article 6 on the regulation of sensitive personal data related to health and sexual life separately from other sensitive data, eliminating the distinction between health and sexual life, and in this context, the conditions for the processing of sensitive personal data have been expanded.

2.1. AMENDMENTS ON CROSS-BORDER PERSONEL DATA TRANSACTIONS (Article 9)

Article 9 of the Law has been completely amended with the new regulation and cross border data transfer on the explicit consent of the data subjects has been eliminated as a prior legal ground. The systematics of cross-border data transfer been changed. With the amendment of the Law, three alternatives are envisaged for the transfer of cross-border data transfer. These alternatives are as follows:

2.2.1. Data Transfer Based on Adequacy Decision

The Amendment introduces the concept of “Adequacy decision”. Accordingly, the Personal Data Protection Board (“Board“) will publish in the Official Gazette every four years at the latest the (i) country, (ii) international organization or (iii) sector for which it has issued an adequacy decision, so that data controllers and data processors can transfer data to the countries, organizations or sectors for which an adequacy decision has been issued.

How to determine the countries, international organizations or sectors that adequacy decisions will be made has been clearly regulated in the Law. The factors that will be effective in the Board’s adequancy decision are as follows:

1. Reciprocity,
2. The legislation of the country to which the data will be transferred and the rules to which the international organization is subject,

• Membership status of the country to which data will be transferred to global/regional organizations of which Türkiye is a member,

1. International treaties to which Turkiye is a

With this regulation and in parallel with the GDPR, data processors are also allowed to make cross-border data transfer in addition to the data controllers.

2.2.2.Transfer Based on Appropriate Safeguards

Transfer based on appropriate safeguards has been regulated as an alternative in cases where there is no adequacy decision. Accordingly, in the absence of an adequacy decision, personal data may be transferred abroad if appropriate safeguards are in place. In order to operate the procedure for transfer based on appropriate safeguards, three precondition must exist:

1. Existence of the conditions specified in Articles 5 and 6 of the Law (conditions for processing personal data and sensitive personal data),
2. The rights of the data subject can be exercised in the country of transfer,

• The existence of effective legal remedies for the protection of personal data in the recipient

country.

Where the three preconditions are met, data transfer abroad has been made legal as a result of the provision of one of the appropriate safeguards listed below by the data transferring and data transferred parties:

1. Existence of an agreement (which is not an international contract) between public institutions and organizations abroad or international organizations, and public institutions and organizations or professional association with public entity status in Türkiye and the Board’s authorization for the transfer.
2. Existence of binding corporate rules approved by the Board that include provisions on the protection of personal data of companies within the group of undertakings engaged in joint economic activity,

• Existence of a standard contract containing the data categories announced by the Board, data transfer purposes, recipients and recipient groups, technical and administrative measures to be taken by the data recipient, additional measures taken for sensitive personal data,

1. Existence of a wriflen undertaking containing provisions to ensure adequate protection and the Board’s authorization for the transfer.

In order for the standard contract, the content of which is regulated and announced by the Board, to be considered within the scope of appropriate assurance, the data controller or data processor must notify the Board within five work days following the signing of the contract. The amendment also introduces an administrative fine sanction for failure to fulfill the notification obligation.

2.2.3. Transfer Based on Occasional Cases

The new regulation grants the possibility of transferring personal data abroad in the absence of an adequacy decision and in cases where appropriate safeguards cannot be provided, in the presence of one of the exceptional circumstances listed below and provided that it is temporary:

1. Explicit consent of the data subject who has been informed of the potential risks,
2. The transfer is mandatory for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the request of the data subject,

• The transfer is mandatory for the establishment or performance of a contract between the data controller and another natural or legal person for the benefit of the data subject.

1. The transfer is mandatory for an overriding public interest,

1. The transfer of personal data is mandatory for the establishment, exercise or protection of a right,
2. vi) The transfer is mandatory to protect the life or physical integrity of the data subject or of another natural person where the data subject cannot disclose their consent due to actual impossibility or whose consent is not legally valid

• The transfer is made from a register that is open to the public or persons with a legitimate interest, to the extent that the conditions laid down by applicable law for accessing the registry and transfer is requested by those having legitimate interest are met.

Finally, it should be noted that the procedures and principles regarding the implementation of Article 9 regulated by the amendment will be determined by the regulation to be issued, and it has been expected that the procedures regarding the transfer of personal data abroad will be further clarified with the publication of the relevant regulation. In addition, the former first paragraph of this article, which prohibits the cross-border data transaction without the consent of the data subject, will continue to be applied until September 1, 2024 with the amended version of the article that entered into force.

2.3. MISDEMEANOURS (Article 18)

Regulation has also been made in Article 18 of the Law regulating misdemeanors. The following amendments have been introduced with this regulation:

1. In case of failure to notify Board within five work days following the signing of the standard contract, the Board will impose an administrative fine from TRY 50,000 to TRY 1,000,000 against the data controller or data processors.
2. The legal remedy against administrative fines to be imposed by the Board has been determined as administrative courts.

There was a dual examining procedure against the Board’s decisions before the amendment. While the Board’s decisions imposing administrative fines were subject to appeal before criminal courts of peace (judicial jurisdiction), and decisions other than administrative fines (such as instructions) were subject to appeal before administrative courts, the new regulation changes this and sets administrative courts as the sole appeal authority against the Board’s decisions.

3. CONCLUSION

On March 12, 2024, the Law No. 7499 on the Amendments of the Code of Criminal Procedure and Certain Laws was published in the Official Gazette and radical amendments were made on the KVKK. With this amendment, it has been aimed to harmonize the Law with the GDPR and to prevent problems in the implementation of the Law.

As explained in detail above, there are two important issues that should be underlined in the regulation. The first of these is the expansion of the conditions for the processing of sensitive personal data, while the second is the introduction of new procedures for the cross-border data transactions.

We believe that the biggest practical impact of the amendments to the Law will be the obligation of data controllers who process sensitive personal data based on the explicit consent and transfer data abroad to review their personal data processing procedures.

The effective date of the amendments has been set as June 1, 2024, with the exception of the first paragraph of Article 9 which allows cross-border personal data transfer regarding data subject’s explicit consent. Article 9 will remain in force until September 1, 2024 with the amendments.