September 2023 – In August 2023, the Turkish Personal Data Protection Authority (the "DPA") issued two decisions and published 12 data breach notifications.
Newly announced: Google now has permission for cross-border data transfers
In August, the DPA granted approval for Google Reklamcilik ve Pazarlama Limited Sirketi ("Google") to transfer personal data abroad. The decision, dated 17 August 2023, came after a thorough evaluation of Google's application with written undertaking for cross-border personal data transfers.
Healthcare institutions' activities based on explicit consent under scrutiny
On 14 August, the DPA published two violation decisions concerning the processing of personal data by healthcare institutions based on the explicit consent of data subjects.
Key points addressed within the decisions include:
- In the first decision, the DPA found that a private healthcare institution's activity was unlawful, ruling that they had engaged in promotional activities by sharing patients' data on social media, despite having the explicit consent of the patients.
In its assessment, the DPA emphasised that data processing activities must align with legal regulations in the broadest sense to be considered legitimate under the principle of processing data for specific, clear, and lawful purposes. Although the healthcare institution claimed that they can carry out informational and promotional activity and that it is legitimate, the DPA stated that to consider an activity as legitimate, it should be in line with the applicable legislation. In this regard, the DPA stated that, despite the fact that the healthcare institution had acquired patients' explicit consent, the activity in the concrete case exceeded informational and promotional activities permitted by Turkish law. Therefore, this processing of personal data was found unlawful, and as a result, the data controller faced an administrative fine of TRY 250,000 (approx. EUR 8,450).
- In the second decision, the DPA reiterated that explicit consent should not be conditional. In this case, a private healthcare institution required patients seeking an appointment to explicitly consent to marketing activities. The DPA ruled that this condition violated the element of "free will". As a result, an administrative fine of TRY 300,000 (approx. EUR 10,140) was imposed on the healthcare institution.
For more details on these decisions, you can access our article summarising them here.
The DPA announced the following data breach notifications in August:
Data Controller |
Affected Data Subjects |
Affected Personal Data |
Number of Data Subjects |
Vodatech Bilisim Proje Danismanlik Sanayi ve Dis Ticaret |
Employees, Family Relatives of Employees, Suppliers, Business Partners, Customer Employees and Employee Candidates |
Identity, Communication, Personnel Information, Finance, Professional Experience Data |
9,746 |
Diler Holding and Below Group Companies
|
Employees and Users |
Identity, Communication, Personnel Information, Legal Transaction, Customer Transaction, Physical Place Security, Transaction Security, Risk Management, Finance, Professional Experience, Marketing Data and Audio and Visual Recordings |
1,200 |
UPS Hizli Kargo Tasimaciligi |
Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
N/A |
AgeSA Hayat ve Emeklilik |
Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
N/A |
Derimod Deri Konfeksiyon Pazarlama Sanayi ve Ticaret |
Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
N/A |
Oto Plan Operasyonel Tasit Kiralama Ticaret |
Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
1,236 |
YOYO Bilgi Teknolojileri ve Turizm Ticaret |
Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
5,464 |
Gulf Sigorta |
Employees and Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
295,288 |
Atatürk Üniversitesi |
Employees and Students |
Identity, Communication, Data, Information on the Department of Education |
Approx. 12,000 |
Puma Spor Giyim Sanayi ve Ticaret |
N/A |
N/A |
N/A |
Dagi Giyim Sanayi ve Ticaret |
Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
6,936 |
Besiktas Sportif Ürünleri Sanayi ve Ticaret |
Customers and Potential Customers |
Identity, Communication, Customer Transaction Data, Audio and Visual Recordings |
Approx. 27,920 |
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.