1-GENERAL

The importance of data in 21st century business life is indisputable. Today, market actors that accelerate digital transformation activities inevitably process and incorporate all kinds of data on which they have the right to save in order to gain competitive advantage in the free market. Even though competition between market actors is always desirable and serves the consumer interest in the final analysis, when it comes to personal data, a need appears to strike a balance between market interests and the protection of personal rights and freedoms. This balance is expressed in the basic principles and data protection conditions adopted in the legal regulations on the protection of personal data, including the transfer of personal data. This article describes the transfer of personal data to third parties in Turkey or abroad; Law Number 6698 on the Protection of Personal Data (Kisisel Verilerin Korunmasi Kanunu 'KVKK') examination will be carried out in the framework.

2- TRANSFERRING PERSONAL DATA AS PERSONEL DATA PROCESSING ACTIVITY

Processing of personal data is defined in Article 3 (three) of the KVKK, entitled Recognitions, as  the acquisition, storage, modification, reorganization, disclosure transferring, taking over, making available, classifying or preventing its use  of personal data in a completely or partially automated or non-automated manner if it is part of any data recording system. Transferring personal data is also one of the types of data processing. However, the provisions regarding the transfer of personal data are regulated in KVKK separately from other types of data processing activities.

3-PERSONAL DATA TRANSFER TO THIRD PARTIES IN TURKEY

The transfer of personal data to third parties in Turkey is regulated in Article 8 (eight) of the KVVK, entitled Transferring Personal Data. Personal data obtained for the purpose of processing in the framework of the principles of the law by taking the express consent of the person concerned can be transferred to third parties in Turkey.

As mentioned, the transfer of personal data is within the scope of personal data processing activities for that reason KVKK is searching for the same conditions with the processing for personal data to be transferred to third parties in Turkey. In this sense, the personal data shall be, provided in accordance with Article 5 -2 of the KVKK or in case of one of the conditions specified in Article 6 -3 of the KVKK provided that adequate measures are taken, transferred to third parties without seeking consent of the person concerned in Turkey. Personal Data Protection Board determines the adequate measures for private personal data that be transferred to third parties in Turkey.

Within the framework of the above description, the transfer of personal data to third parties in Turkey must have one of the following cases:

  • Obtaining the express consent of the person concerned,
  • Explicitly stipulated in the law,
  • It is compulsory for the protection of the life or body integrity of the person or someone else who is unable to disclose his consent due to the impossibility or whose consent is not granted legal validity,
  • The processing of personal data of the parties to the contract is required, provided that it is directly related to the establishment or performance of a contract,
  • It is obligatory for the data officer to fulfill his legal obligation,
  • Having been publicized by the person concerned,
  • Data processing is mandatory for the establishment, use or protection of a right,
  • Providing that data is compulsory for the legitimate interests of the data officer, provided that they do not harm the fundamental rights and freedoms of the person concerned.

In addition, in order to transfer private personal data at in Turkey; one of the following cases must be present.

  • In case the explicit consent of the person concerned is obtained,
  • If it is explicitly provided for by law in terms of personal data other than health and sexual life,
  • In terms of personal data related to health and sexual life, the persons or authorized institutions and organizations under the obligation of keeping secrets in order to protect public health, to perform preventive medicine, medical diagnosis, treatment and care services, to plan, manage and financing of health services,

4- TRANSFERRING PERSONAL DATA ABROAD

The transfer of personal data abroad is regulated in Article 9 (nine) of the KVVK, entitled Transfer of Personal Data Abroad. In KVKK, the transfer of personal data abroad is prohibited as a rule if the person concerned does not have explicit consent. However, in addition to the exceptions set forth in Articles 5 and 6 of the KVKK, which allow the transfer of personal data without the express consent of the person concerned, it is compulsory to make assessments on the data protection regulations of the country in which the personal data will be transferred;  In this sense, the personal data shall be transferred to foreign countries if a) there is adequate protection, b) in the absence of adequate protection, adequate protection of responsible data officers  from Turkey and in the relevant foreign country to commit themselves in writing and permission from the Board of Protection of Personal Data is obligatory. Countries with adequate protection shall be announced separately by the Board.

Within the framework of our explanations above, personal data transfer abroad according to Article 9 (nine) of KVKK;

  • Having the express consent of the person concerned,
  • Existence of the conditions specified in the Law (conditions specified in Article 5 and Article 6 of KVKK) when transferring data to countries with adequate protection (those considered safe by the Board).
  • Data transfer to countries where there is not enough protection in the presence of the conditions specified in the Law (Article 5, paragraph 2, Article 6, paragraph 3 of KVKK) can be realized in case of a written commitment of adequate protection and permission of the Board.

The law seeks the same conditions for the processing of personal data and the transfer of such data abroad. In addition, it is envisaged that additional measures will be taken for the transfer of personal data abroad.

If the person has express consent, it is possible to transfer personal data abroad. In cases other than express consent, the Law introduces different provisions for the transfer of personal data abroad, depending on whether there is enough protection in the country of transfer;

A- In case of adequate protection;

Personal data;

  • Explicitly stipulated in the law,
  • It is compulsory for the protection of the life or body integrity of the person or someone else who is unable to disclose his consent due to the impossibility or whose consent is not granted legal validity,
  • The processing of personal data of the parties to the contract is required, if it is directly related to the establishment or performance of a contract,
  • It is obligatory for the data officer to fulfill his legal obligation,
  • Having been publicized by the person concerned,
  • Data processing is mandatory for the establishment, use or protection of a right,
  • Providing that data is compulsory for the legitimate interests of the data officer, if they do not harm the fundamental rights and freedoms of the person concerned

can be transferred abroad.

B- Private Personal Data

  • Personal data other than health and sexual life shall be transferred abroad if expressly stipulated by law and if there is adequate protection in the country in which the personal data will be transferred.
  • In countries with adequate protection, personal data on health and sexual life of persons, for the purpose of the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services, can be transferred abroad by organizations, without seeking the express consent of the person concerned by authorized institutions with confidentiality obligation.
  • Countries with adequate protection shall be announced by the Board.

C- For data transfer to countries that are not adequately protected;

  • The fulfillment of at least one of the conditions listed in Article 5 or Article 6 of the Law,
  • Adequate protection of responsible data officers in Turkey and foreign countries to commit themselves in writing,
  • Permission of the Board is required.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.