Recent Amendments To The Law On The Protection Of Personal Data

On March 12, 2024, the Law Amending the Code of Criminal Procedure and Certain Laws ("Law") was published in the Official Gazette Numbered 32487. Significant amendments regarding the processing of sensitive personal data, cross-border transfer of personal data, administrative fines, and the appeal authority have been made to the Personal Data Protection Law No. 6698 ("KVKK") with this published Law.

With this Law, the following amendments have been made to the KVKK:

• The lawfulness criteria foreseen for the processing of special categories of personal data have been expanded. Processing of sensitive personal data has become possible in the presence of reasons such as the consent of the data subject, explicitly stipulated in the law, actual impossibility, publicization of personal data by the data subject, establishment, use, or protection of a right, persons under the obligation of confidentiality, employment, occupational health and safety, social security, social services, and social assistance.
• Before the amendment, personal data could not be transferred abroad without the explicit consent of the data subject. With the amendment, personal data may be transferred abroad if one of the conditions for the processing of personal data regulated in the KVKK or the conditions for the processing of special categories of personal data is present and if there is a "qualification decision" about the country, sectors within the country or international organizations to which the transfer will be made. This new regulation will be applicable as of September 1, 2024, until which date the explicit consent of the data subject will also be required for the transfer of personal data abroad.
• The qualification decision will be made by the Personal Data Protection Board and published in the Official Gazette. The qualification decision will be evaluated at the latest every four years. The Board may modify, suspend, or revoke the qualification decision with prospective effect as a result of the evaluation or in other cases it deems necessary.
• In the absence of an adequacy decision, personal data may be transferred abroad if one of the appropriate safeguards specified in Article 9/4 of the KVKK is provided by the parties, provided that one of the conditions for the processing of personal data or conditions for the processing of special categories of personal data regulated in the KVKK exists, and the data subject has the opportunity to exercise his/her rights and to apply for effective legal remedies in the country where the transfer will be made.
• In the absence of both an adequacy decision and any of the above-mentioned appropriate safeguards, it will only be able to transfer personal data abroad in the presence of one of the situations in Article 9/6 of the KVKK, provided that it is incidental.
• The standard contract will be notified to the Personal Data Protection Authority by the data controller or data processor within five business days of its signature. Those who fail to fulfill this notification obligation will be subject to an administrative fine from 50,000 Turkish Liras to 1,000,000 Turkish Liras.
• Administrative fines imposed by the Personal Data Protection Board may be challenged before administrative courts.
• According to Provisional Article 2 added to the Law, applications pending before criminal judgeships of peace as of June 1, 2024, will continue to be heard by these judgeships.
• These regulations will enter into force on June 1, 2024.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.