With the amendment Law published on Tuesday, Mar 12th 2024 and announced in the Official Gazette No. 32487; Articles 6, 9, and 18 have been amended of the Personal Data Protection Law No. 6698 (“KVKK” or “Law”).
The first amendment to the Law is related to the Article 6 of the KVKK titled “conditions for processing of sensitive personal data” and the processing of such data is prohibited without certain conditions and special conditions are imposed for its processing.
In addition to requiring explicit consent of the data subject in the processing of sensitive personal data, the amendment requires clear predictability in the law, protection of the life or physical integrity of people who are unable to give consent due to practical impossibility, compatibility of the personal data made public with the will to make it public, being mandatory for the establishment, use and protection of a right, being necessary for the purpose of protecting public health and facilitating health services, being mandatory for legal obligations in the fields of social assistance and social security, being in accordance with legislation and purposes of non-profit organizations and formations and being intended for people who are in constant contact conditions have been provided.
Within this framework, in addition to the explicit consent of the data subject in the conditions for the processing of sensitive personal data, different situations have been added in line with the principle of numerus clausus, and the procedure for processing sensitive personal data has been stretched within a certain framework.
Another amendment made in the Law is related to Article 9 titled transfer of personal data abroad and new conditions have been introduced regarding the transfer of personal data abroad.
With the amendments made, this transfer, which cannot take place without the explicit consent of the data subject or the written decision of the KVK Board (“Board”) stating that if the country to be transferred provides adequate protection, data supervisor will now be able to transfer personal data abroad by taking an adequacy decision subsequently the herein amendment. The Board will make the adequacy decision and evaluate it at regular intervals. When making the adequacy decision, the relations of the country or organization to be transferred with Turkey, its membership status in international agreements, and data protection policies will be taken into consideration. In cases where an adequacy decision cannot be made, transfer can be made if certain conditions are met and appropriate assurances are available.
With this amendment, the transfer of personal data abroad is aimed to be in accordance with the European Union General Data Protection Regulation (“GDPR”).
Another amendment made in the Law is related to Article 18 titled Misdemeanors, and a new administrative fine has been added and it has been regulated that cases to be filed regarding administrative fines will be heard by the administrative jurisdiction.
As a result of the amendments made, while there is an obligation to notify the KVK Authority within five business days of the standard contract regulated in Article 9, Paragraph 5 of the Law, administrative fines have been imposed against the data controller or data processor real persons and private law legal entities who do not fulfill this notification obligation. While cases filed against administrative fines were heard by the Turkish Criminal Judgeship of Peace in the practice before the amendment, they will be heard in administrative courts in the new regulation.
The added administrative fine aims to increase deterrence, and a more systematic way of objection has been established by having the cases heard by administrative courts.
As a matter of fact, the aim of all these amendments is to systematize data processing and transfer by ensuring compliance with the European Union data protection legislation.
For detailed assistance and information: [email protected] / +902123259020
