ITCA Published New Principles and Procedures for Social Network Providers

Incorporation requirements

ITCA states that the entity that meets the following requirements is deemed as the representative:

• The name of the representative must bear the unique tradename of the social network provider and the province where the entity is incorporated (e.g., Istanbul).
• All of the entity’s shares must be owned by the social network provider.
• The articles of association must state that the representative is incorporated within the organization of the social network provider and is affiliated to the social network provider.
• Principal capital must be at least TRY 100 million (approx. USD 5 million).
• The articles of association must state that the social network provider holds the representative fully authorized, and the representative has full technical, administrative, legal, and financial liability.

Documentation attesting the above and the following documents must also be submitted to the ITCA:

• The representative’s article of association
• Trade registry gazette and other incorporation-related documentation
• Signature circular or other documentation showing the authorization of responsible individuals of the representative entity (i.e., authorized signatories of the representative)
• Identity and contact information of the authorized signatory(ies).

Additionally, if the representative is a real person where the social network provider’s daily access from Türkiye does not exceed 10 million, documents showing that the representative is a Turkish citizen and resident in Türkiye must be submitted to the ITCA.

Any changes to the above documentation or information must be notified to the ITCA immediately and no later than 72 hours.

Duties of the representative

The representative has the following duties:

• Taking the necessary actions to comply with the notifications, notices or requests from the ITCA, Access Providers’ Union or administrative authorities
• Responding to individual applications
• Compliance with reporting obligations (i.e., semi-annual/transparency reports)
• Complying with the obligations of the social network provider, which arise from the content provider or hosting provider status of the social network provider
• Compliance with other obligations under the Internet Law

Other requirements are as follows:

• Representative’s notification address and email address (including registered email address*) must be easily accessible on the social network provider’s platform
• Any changes to the representative’s contact information must be updated on the platform

*Having a registered email address (i.e., KEP address) was not a regulatory requirement for representatives previously. It appears that this was introduced to facilitate the delivery of notifications to the representative.

1. ITCA issues warning
2. Administrative fine of TRY 10,000,000 (approx. USD 520,000) for failure to comply within 30 days of the receipt of the ITCA’s warning
3. Administrative fine of TRY 30,000,000 (approx. USD 1,560,000) for failure to comply within 30 days of the implementation of the first set of fines
4. Advertisement ban for failure to comply within 30 days of the implementation of the second set of fines
5. Internet bandwidth reduction by 50% for failure to comply within three months of the issuance of advertisement ban
6. Internet bandwidth reduction up to 90% for failure to comply within 30 days of the implementation of the initial bandwidth reduction (the judgeship cannot issue a bandwidth reduction order below 50%, but it can determine a percentage below 90% depending on the nature of the service)

*If the social network provider fulfills the representative requirement, only one-quarter of the administrative fines will be collected.

The New Principles and Procedures indicate that the social network providers must facilitate the receipt of the individual applications. Accordingly, users should be able to send their requests in Turkish language, and social network providers must respond to such requests in Turkish.

*Upon the complaint of a user to the ITCA, the ITCA evaluates whether the social network provider is complying with its requirements to respond to users. The ITCA evaluates the user complaints collectively during the semi-annual (transparency) report periods. In its evaluation, the ITCA takes into account whether the social network provider does the following:

• Established relevant systems to effectively respond to users
• Responds negatively to certain users or authorities on a regular basis,
• Complies with the timeframes envisaged in the Internet Law systematically
• Includes in its responses the rationale for objection/rejection of the application

• Technical infrastructure, personnel and administrative capacity to ensure the enforcement of content takedown procedures and responding to individual applications
• Duration, geographical aspects and means of execution/implementation of decisions
• Categorical and statistical information on the process of handling individual applications, such as the number and type, positive and negative evaluation of applications, reasons for a negative response, response time
• Categorical and statistical information on the decisions of authorities, including the authority, means of receipt of the decisions, legal basis of the takedown order (e.g., Article 8 of the Internet Law), and timeframe for complying with the takedown order
• Categorical and statistical information on the self-assessment process
• Measures for equal and unbiased treatment of users
• Measures that allow users (i) to update their preferences regarding “recommended content” and (ii) to limit the use of personal data
• Information on the algorithms and transparency policies regarding hashtags, featured or restricted content
• Measures regarding the non-publication of content and hashtags relating to crimes under the Internet Law
• Advertisement policies
• Advertisement library

The report to be prepared on the individual applications (i.e., Article 9 and 9/A requests) must also be published on the social network provider’s website without revealing any personal data.

In addition, the ITCA states that social network providers must comply with accountability principles and submit any necessary information and documentation as requested by the ITCA to ensure transparency.

• Details of the advertisement
• Type of the advertisement
• Ad provider
• The airtime of the advertisement
• The target audience of the advertisement and parameters used to define the target audience
• Number of individuals and groups reached with the advertisement

The advertisement library must be easily accessible on the social network provider’s website.

• Sexual abuse of children (Article 103 of the Penal Code)
• Public dissemination of misleading information (Article 217/A of the Penal Code)
• Disruption of the unity and territorial integrity of the state (Article 302 of the Penal Code)
• Offences against the constitutional order and its functioning (Articles 309, 311, 312, 313, 314, 315, 316 of the Penal Code)
• Crimes against state secrets and espionage (Articles 328, 329, 330, 331, 333, 334, 335, 336, 337 of the Penal Code)

The ITCA clarifies that the representative must directly respond to user data requests related to the above offences.

If social network providers comply with the user data/information request, the internet bandwidth reduction order is revoked.

The New Principles and Procedures clarify that the basic user information and information that may be required by the ITCA must be prioritized during the exercise of the data localization requirement.

The New Principles and Procedures clarifies that social network providers must take into account the following during the display of content, advertisements and provision of services to children:

• Age of the children
• Best interest of the children
• Protection of the physical, psychological and emotional development of the children
• Prevention of child abuse and commercial exploitation of the children
• Processing of minimum children data by applying high privacy settings
• Display of a user agreement, privacy policy and user settings in a manner that is understandable by children.

• Social network providers must treat users equally and in an unbiased manner
• Social network providers must take measures to allow users to update their settings as to the recommended content and restriction on the use of personal data
• Social network providers must notify the users accessing the platform from Türkiye and the ITCA in cases of serious security breaches that directly or indirectly affect users from Türkiye within 72 hours
• Social network providers must make available in an easily accessible manner any update that affects the rights of the users
• Social network providers must provide information on the website as to which parameters the social network provider uses when recommending content to users in a clear, comprehensible and easily accessible manner
• Social network providers must provide understandable and easily accessible reporting channels (available in Turkish) for users to reach out in case of stolen and imposter accounts, and finalize the applications of users within due time.
• Social network providers must follow any additional guidance that may be given by the ITCA regarding user rights.

The New Principles and Procedures state that the social network providers must inform the ITCA regarding this mechanism as part of semi-annual reports.

Social network providers must provide the requested information and documentation within no later than three months.

The New Principles and Procedures state that the ITCA may inform the social network providers regarding the aspects of preparation and disclosure of the crisis management plan.

• The social network provider is responsible for the indemnification of damages due to non-compliance with a content takedown order/decision within 24 hours. This legal responsibility does not require filing of a separate lawsuit for this purpose.
• The social network provider is legally responsible for crimes committed through hashtags or featured content if it fails to takedown the content promptly and within no later than four hours from the official notification.

2. The ITCA can issue an advertisement ban for up to six months (the advertisement ban is not automatically lifted following compliance with the ITCA order)

3. The ITCA can request from the judgeship of peace to order an internet bandwidth reduction by 50% (irrespective of the advertisement ban)

4. Internet bandwidth reduction by 90% for failure to comply within 30 days of the initial internet bandwidth reduction decision