Sensitive and non-sensitive personal data can be transferred abroad if the data subject's explicit consent is obtained.
Furthermore, other legal grounds will also apply to transferring personal data to a foreign country. However, the destination country must have “sufficient protection” to conclude the transfer abroad based on legal grounds (except for having obtained explicit consent). A list of jurisdictions that provide sufficient protection is to be determined by the Board. The DPA has confirmed that they have been working on the list of safe countries regarding the data transfer abroad, yet since the referred list is prepared based on reciprocity, for now, no foreign country has been announced to be safe by the Board.
According to the Data Protection Law, if sufficient protection in the destination country for the realisation of the data transfer does not exist, both:
- The data controller in Turkey and the foreign country must provide a written commitment, stating that sufficient data protection will be provided; and
- Authorisation must be obtained from the Board to transfer data to the relevant foreign country.
However, we have seen that obtaining a permit from the Board upon submitting a written commitment is not a transparent process, and there is no predictable timeline either as to when the parties may reach such a permit from the Board. Thus, making an application to the Board through submission of commitments in and of itself, or submitting intercompany transfer agreements, is not considered adequate. Also, it would be appropriate to note that a limited number of business enterprises have made such an application and obtained a permit to transfer data abroad.
As an alternative method for transferring data between multinational group companies where there is not sufficient protection in the destination country, the Board introduced the concept of Binding Corporate Rules (“BCR”). Accordingly, Binding Corporate Rules may be submitted to the Board, and the DPA's approval must be obtained to transfer personal data legally between multinational group companies, without the need to obtain explicit consent (in cases where the processing of personal data may be made based on legal grounds other than explicit consent, i.e. execution of the agreement, the exercise of legal rights, or fulfilling legal requirements, etc.).
The fact that there is currently no fast solution for the transfer of personal data abroad except for obtaining explicit consent, and that the legal instruments, such as standard contractual clauses, alone, are not adequate for the transfer of personal data abroad, undisputedly reveals that an amendment to the Law must resolve this issue. It is expected to resolve this issue by taking concrete steps in the short term under the current legislation, as it also affects commercial relations. Within this scope, it is seen that certain amendments are planned to be made to Article 9 on the transfer of personal data abroad, as a part of the proposed amendments to the Data Protection Law, which the DPA has shared with stakeholders in the sector. Referred proposed amendments have not been finalised and enacted yet. However, it is a meaningful development in that the deficiency pointed out by us has also been accepted by the DPA, and they have been working to remedy it. Our assessments on the content of amendments are presented in the relevant section of this document.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.