The Draft Law Amending the Personal Data Protection Law is in Parliament!

The draft law, which has been in the works for about eight years and which will modify provisions that effectively oblige most companies to obtain additional explicit consent for the transfer of personal data abroad, has finally been submitted to the Turkish Grand National Assembly. This has been an issue particularly for group companies transferring data abroad or utilising cloud-computing services.

The draft law proposes amendments reflecting the European Union's General Data Protection Regulation ("GDPR") on the processing of special categories of personal data and the transfer of personal data abroad. We have summarised the noteworthy points for you:

• Many new legal grounds for processing special categories of personal data have been introduced, in addition to explicit consent for the processing of special categories of personal data. In general, the legal grounds that can be relied upon in data processing (stipulated by law, compliance with a legal obligation, etc.) are also valid for special categories of data. Additionally, the following legal grounds have been introduced to process special categories of personal data:
• Fulfilment of obligations regarding employment and occupational health, safety, and similar issues;
• Fulfilment of obligations related to the activities of associations, foundations, and similar organisations.
• Fundamental changes have been made regarding the transfer of personal data abroad. The "explicit consent" method, which has been the main rule, has been abandoned. Accordingly, if one of the processing grounds is present and an adequacy decision has been rendered, the transfer can be made without explicit consent. An adequacy decision can be issued for a country as well as an international organisation in a foreign country or for certain business sectors within that country. Although the reciprocity condition for the adequacy decision is preserved, additional mechanisms have been introduced.
• In the absence of an adequacy decision, data may be transferred provided that one of the conditions for processing exists, the data subject has the possibility of legal remedies in the destination country, and one of the following safeguards is provided:
• The existence of binding corporate rules approved by the Board, which companies within a group of undertakings that engage in joint economic activity are obliged to comply with;
• The existence of a standard contract announced by the Board (it must be notified to the Authority within five business days after signing);  or
• The existence of a written commitment letter containing provisions to ensure adequate protection and permission to the transfer by the Board. Data processors will also be able to transfer such data under these conditions.
• In the absence of an adequacy decision and failure to provide any of the abovementioned assurances, the transfer can only be made if one of the data processing conditions exists (explicit consent, performance of the contract, fulfilment of legal obligation, etc.), provided that it is incidental.
• The procedures and principles regarding the transfer will be determined in a separate regulation.
• In the event that the standard contract is not notified in a timely manner, an administrative fine from 50,000 Turkish Liras to 1,000,000 Turkish Liras may be imposed. For the first time, the Draft Law regulates that sanctions may also be imposed on the data processor only in terms of this obligation.
• Administrative fines imposed by the Board can now be challenged in administrative courts, not in criminal courts of peace.
• The paragraph stating that personal data cannot be transferred abroad without explicit consent will continue to be in force until 1 September 2024 together with the new mechanisms introduced by the amendment.
• As of 1 June 2024, files pending before the criminal courts of peace will continue to be adjudicated by the same judges.