Turkish KVKK(PDPL) Amendments: A New Dawn
🇹🇷 Special Interview: Attorney Görkem Gökçe Unravels Türkiye's Leap Towards Global Data Privacy Standards
Welcome to a special edition of AI Boost. Today we're tackling a topic that's set to reshape the landscape of personal data protection in Türkiye.
Joining me is none other than Attorney Görkem Gökçe,
a vanguard in the field with an impressive track record that speaks volumes—training at Istanbul University Law Faculty, experience from the distinguished office of Prof. Necip Ortan, honing his expertise at Denton Wilde Sapte, and further refining his legal prowess with studies at Istanbul University and courses in commercial law at Harvard University. The founder of Gökçe Attorney Partnership, Görkem has been instrumental in major mergers, acquisitions, and project financing, not to mention earning accolades for his work in internet investments.
👩🏼💻 NK: Can you break down the significance of these amendments to the PDPL for our audience?
👨⚖️ Görkem Gökçe: The significance of these amendments cannot be overstated. They're not just incremental changes; they're about enhancing the existing law to meet the challenges and demands of our increasingly digital world. By refining the PDPL, we're moving towards a regulatory environment that better serves the needs of individuals and businesses alike.
The most critical amendments revolve around the transfer of personal data abroad and the processing of special categories of personal data. These areas have been contentious, and the lack of clarity in the original PDPL presented real obstacles to international business operations and to ensuring the privacy rights of individuals.
Regarding special categories of personal data, the PDPL now allows for processing without explicit consent under legal obligations in certain fields, with necessary conditions, of course. This is a substantial shift, particularly relevant to employment and social services.
Now, with the amendments, we're adopting a system that is more in tune with global data protection trends. By aligning more closely with the GDPR, Türkiye is sending a strong message to the world about its commitment to data privacy and security. I believe this will boost Turkey's confidence with international shareholders and investors, which is crucial for Turkey's position in the global market.
👩🏼💻 NK: Could you elaborate on the changes we're looking at, particularly concerning data transfer and the processing of special categories of personal data?
👨⚖️ GG: Certainly. The amendments redefine the conditions under which personal data can be transferred outside of Türkiye, introducing a three-tiered system: adequacy decision, appropriate safeguards, and occasional (not repetitive) circumstances.
In addition, in the new regulation, in line with the GDPR systematics, data processors are listed together with the data controller as the main subject of the transfer process. Therefore, the three-stage transfer process when transferring personal data abroad is as follows:
There must be an adequacy decision issued by the Personal Data Protection Board (Board) for the country or specific sectors to which the personal data will be transferred (however, the Board has not yet published a sector or country-based adequacy decision)
If there is no adequacy decision, the parties will only be able to transfer the data abroad if they provide one of the specified assurances.
If the parties cannot provide the safeguards, they will only be able to transfer personal data abroad for " occasional cases". The first situation in which personal data can be transferred abroad, provided that it is occasional, is the explicit consent of the data subject to the transfer, provided that the data subject is informed about the possible risks. In this context, with the new regulation, data transfer abroad based on explicit consent will be restricted.
👩🏼💻 NK: What should companies be mindful of with the new regulation on data transfer abroad?
👨⚖️ GG: Companies need to recognize the fundamental shift in data transfer policy.
Firstly, they should check if the country they're transferring data to has been deemed adequate by the Board.
Also, they must ensure they have appropriate safeguards in place, such as binding corporate rules or standard contractual clauses.
Obtaining explicit consent for data transfers abroad is now a narrow procedure reserved for specific, not occasional situations. It is crucial for companies to be proactive and fully grasp these changes in order to avoid non-compliance risks.
👩🏼💻 NK: How about the implications of standard contracts and binding corporate rules in this context?
👨⚖️ GG: These will serve as methods for transferring data, with standard contracts needing notification to the Authority within five days. Binding corporate rules, once approved, allow intra-group transfers without additional authorization, a significant development for international companies.
👩🏼💻 NK: With the transition period leading up to September 1, 2024, what are your recommendations for companies?
👨⚖️ GG: Firstly, I should mention that the new amendment envisages a two-stage transition period for these changes:
Regulations pertaining to data transfer abroad based on explicit consent will remain in effect until 1 September 2024. After this date, explicit consent for data transfer abroad can only be applied in occasional cases and on condition that the data subjects are informed about the possible risks.
The remaining regulations will come into force on 1 June 2024.
It is crucial for data controllers and processors to consider their compliance strategies and reorganize their activities in line with the amendments, in particular with regard to data transfers abroad. Existing processes should be comprehensively reviewed, together with the new structures for explicit consent.
And to you, our readers, we hope this discussion has provided clarity on the upcoming shifts in personal data protection legislation in Türkiye. These changes aren't just for legal compliance; they're about safeguarding the rights of individuals in an ever-expanding digital universe.
If you have thoughts, comments, or questions on the PDPL amendments, share them with us below. And for more updates on the intersection of law and technology, make sure to hit that subscribe button.
Until next time, stay informed and stay ahead of the curve.