Procedures and Principles Regarding Social Network Provider Published

The Procedures and Principles on the Social Network Provider (Decision), issued with the decision of the Information Technologies and Communications Authority (Authority) dated 28.03.2023 and numbered 2023/DK-ID/119, was published in the Official Gazette dated 01.04.2023.

This time, Authority made some changes in the obligations of the social network provider and the procedures and principles regarding the implementation of these obligations, which for the first time was issued with the abrogated decision numbered 2020/DK-ID/274 on 29.09.2020. The aforesaid amendments are majorly parallel to the amendments made in the Law on the Regulation of Broadcasts Made on the Internet and Combating Crimes Committed Through These Broadcasts (Law) on 13.10.2022.

In line with the Law, foreign-based social network providers with daily access from Turkey more than one million are obliged to designate at least one natural person or legal entity as their representative.

There are more detailed regulations when compared to the Law for foreign-based social network providers with daily access of more than ten million from Turkey. As stated in the Law, the Decision reiterates that the representatives of foreign-based social network providers whose daily access from Turkey is more than ten million; are fully authorized and responsible technically, administratively, legally and financially, without prejudice to the responsibilities of the social network provider. In addition, it is stated in the Decision that if the representatives of social network providers above this base are legal entities, the representative must be a branch established as a corporation and, as a critical issue, the registered capital must be at least 100 million Turkish Liras.

The obligations that the representative must comply with are regulated in more detail with Decision. We have summarized the primary ones below:

• The issues to be included in the reports that the representative should submit to the Authority every six months were detailed. Accordingly, foreign-based social network providers with daily access of more than one million from Turkey, should submit reports containing statistics and categorical information on the implementation of the decisions to remove and/or block access to the content notified to them, and the applications to be made by individuals, to the Authority in two periods: 1 January-30 June and 1 July-31 December. The aforesaid reports shall contain including the information on the technical infrastructure for the implementation of the decisions to remove content and/or blocking access, and the reception and evaluation of applications by individuals, and the personnel qualifications and administrative capacity to implement the decisions, detailed process information on the time and manner of implementation of the decisions and their geographical scope, information about the process, such as the number, type, affirmative or unfavourable evaluation, response, reasons for the unfavourable answers, and the duration of the applications from individuals, categorical information about the decisions sent by judicial or administrative authorities and advertising policies.
• Moreover, Decision detailed the obligation to create an ad library of foreign-based social network providers which have a daily access of more than one million in Turkey, which was previously included in the amendments to the Law. Accordingly, the relevant providers must also include in their advertisement libraries the information such as the content of the advertisement, its type, the advertiser, the period in which the advertisement is broadcasted, and the target audience.
• Another obligation parallel to the Law is to inform the judicial authorities. In this context, if requested by the prosecutor or the court, regardless of the access limit, all social network providers are obliged to provide the information necessary to reach the perpetrators who create or spread the internet content subject to the crimes stated in Article 12 of the Decision.
• Again, regardless of the number of access, social network providers are obliged to take the necessary measures to provide segregated services specific to children. While it is regulated in the Law that only the social network provider should take the necessary measures to provide segregated services specific to children, according to Article 14 of the Decision, the social network provider must ensure that the followings were taken into consideration in detail: The age of the child in the content, advertisement and other services offered to users who can be comprehended as children, the protection of the child’s best interests, the protection of the child’s physical, psychological and emotional development, the prevention of the risks of sexual abuse and commercial exploitation of the child, the protection of personal data belonging to the child with a high level of confidentiality and minimum data processing and presenting user agreements and policies in a way that the child can understand.
• A nuance was introduced to the obligation to host the data of users in Turkey within Turkey for the social network provider with daily access of more than one million from Turkey: It was regulated that hosting the basic user information data and information related to matters that might be informed by the Authority, within Turkey, should be prioritized.
• In terms of protecting the rights of the users, the obligations imposed on the social network providers by the Law amendments, regardless of the number of accesses, were regulated in detail in the Decision. Accordingly, the social network provider is obliged to act equally and impartially among users, to provide users with the option to update their preferences for the content they offer and to limit the use of their personal data, and to ensure that users can easily access updates that affect user rights in the services offered. In addition, the social network provider is required to inform the Authority and users in Turkish and clearly, following the detection of significant security breaches related to user accounts that directly or indirectly affect users accessing from Turkey, within 72 hours at the latest.
• There is a significant regulation in the Decision regarding the actions of the account hacking, which is frequently on the agenda. Accordingly, the social network provider is obliged to establish a Turkish, clear, understandable and easily accessible application mechanism for the accounts that have been hacked or imitated, and to conclude the applications in a reasonable manner. It is required to inform the Authority about this application mechanism during the reporting period.
• Another obligation that draws attention in the Decision is related to the safety of life and property. As in the Law, the social network provider is obliged to share the content and the information about the creator of the content with the authorized law enforcement units, when they learn the content that endanger the life and property safety of individuals and in cases which is inconvenient to delay. In addition, the social network provider is obliged to create a crisis plan for emergency situations affecting public safety and public health and notify the Authority. On the other hand, it is also stated that the issues regarding the creation of a crisis plan and its notification to the Authority can be determined by the Authority and informed to the provider.

As a result, the reflections of the changes made in the Law and the experience gained with the use of social media can be seen from the Decision.

In the Decision, it is foreseen to impose administrative fines in different scales in case of breach of obligations. In the current situation, the process of ensuring compliance with the new obligations of social network providers that have representatives in Turkey and have a high access number has become significant.

You can reach the full text of the Decision here (only available in Turkish) which was published by the Official Gazette and the full text here (only available in Turkish) which was published by the Authority.