Aybüke graduated from Yeditepe
 University Faculty of Law in 2019. She has been working at the IT Department in
 Kavlak Law Firm focusing on personal data protection law, e-commerce law, IT
 and technology law. She provides legal assistance to local and multinational
 clients on legal compliance, personal data protection compliance and IT
 agreements. Practice Areas &amp; Work Department

IT Law

Personal Data Protection Law 

E-Commerce Law

Compliance

&nbsp; 

Languages

Turkish

English

As an independent full-service law firm, KAVLAK provides
solutions and practical approaches for a wide range of legal issues to domestic
and international clients since 2006. Our team is experienced in providing
specialist expertise to clients based in the USA, UK and EMEA to reach their
significant potential for global expansion. KAVLAK has a high reputation in
providing legal services to innovative, technology-driven businesses.Our lawyers are recognized for practical legal and business
guidance and provide unique customized commercial advice to your business. We
have extensive experience and interdisciplinary approach to advising start-ups
on company formation, equity structures, Investments, IP rights and other
topics vital to their success. Over the
years, we have built a long track record of working in key industries and
markets, mainly legaltech, fintech, ecommerce, big data, supply chain
management &amp; logistics, AI, B2B software and leisure &amp;
entertainment.&nbsp;We provide legal
consultancy services to our clients by utilising our global network of start-up
ecosystem.

Kavlak Law Firm

Attorney at Law

&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">The Information Commissioner's Office ("&lt;/span>&lt;strong style="font-size: 14px;">ICO&lt;/strong>&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">") released the
Tech Horizons Report (“&lt;/span>&lt;strong>Report&lt;/strong>&lt;span style="font-size: 14px;">”), which addresses the most significant
technological developments for privacy in the next two to five years, as well
as the current range of risks that may harm people's privacy and trust in these
technologies. The Report focuses on applied technologies that have more certain
implications for privacy in the near future. In the Report the following four
technologies: consumer healthtech, next-generation Internet of Things (IoT),
immersive technology, and decentralized finance are discussed in detail.&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;strong style="font-size: 14px; font-family: Arial, Helvetica, sans-serif;">Consumer Healthtech&lt;/strong>&lt;br>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Consumer healthtech can improve wellbeing by tracking health metrics
and promoting healthy habits, but increased data processing must be considered
in this regard. Automated therapy and wearable technologies are given as examples
in the Report. According to the Report, main data protection and privacy issues
in developing consumer healthtech technology are as follows;&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;ul style="list-style-type: square;">&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Some consumer healthtech devices will generate special category
     data, requiring additional safeguards and create risk of unproper processing,
&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;"> Action is needed to ensure that users have meaningful
     transparency and control of processing of their personal information,&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Some consumer healthtech devices present issues in terms of
     accuracy and bias,&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Poor data management&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;/ul>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">To eliminate these issues, organizations must develop healthtech in
a privacy-positive way. They should provide clear privacy notices, be transparent
about processing special category data, and ensure that algorithmic processing
and AI use are accurate, fair, and checked for systemic bias.&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;strong>Next Generation IOT Devices&lt;/strong>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Internet of Things (“IoT”) is an evolving technology. IoT devices
have potential to reduce carbon footprints, assist vulnerable people, and
improve productivity. However, developers and regulators must address data
protection compliance issues following that:&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;ul style="list-style-type: square;">&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Widespread use of next
generation IoT devices may increase cybersecurity risks&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Action is needed to provide
people with meaningful transparency and control of their personal information&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Concerns exist about excessive
collection or repurposing of personal information&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;/ul>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Organisations should consider to take additional steps in order to implement
privacy-positive innovation by enhancing IoT device security. Some security
principles are outlined in the upcoming Product Security and Telecommunications
Infrastructure Bill. Also, taking into account the European Telecommunications
Standards Institute’s IoT security standard, ensuring high standards of privacy
by default, exploring approaches to transparency and data minimization in smart
spaces, being aware of the unique privacy and security challenges of edge
computing, and exploring the potential of privacy enhancing techniques in the
context of connected devices are of importance in checking the privacy risks of
IoT devices.&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">As declared in the Report ICO intends to develop a guidance on the
aspects, continue the support on the default security standards, continue the
engagement with stakeholders in the property sector on their privacy readiness
for future IoT deployments.&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;strong>Immersive Technology&lt;/strong>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">The Report focuses on the immersive technology nearer term and more
common applications of augmented reality (“&lt;/span>&lt;strong style="font-size: 14px;">AR&lt;/strong>&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">”) and virtual reality (“&lt;/span>&lt;strong style="font-size: 14px;">VR&lt;/strong>&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">”).
As VR and AR gain popularity, including listed below issues privacy concerns
will arise due to the collection and processing of potentially sensitive data.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;ul style="list-style-type: square;">&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Many immersive technologies will collect information about
     sensitive human characteristics, requiring additional safeguards,&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Immersive technologies collect large volumes of personal
     information, prompting questions about data minimization,&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Consideration needs to be given to how to provide transparency for
     the designated user,&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Concerns exist about lack of transparency for third parties whose
     personal information may be collected.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;/ul>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Especially in immersive technologies embedding privacy by design is
critical to safeguarding people's privacy rights. Businesses developing these
technologies should explore technical and policy solutions to manage privacy
risks and maximize opportunities. AR and VR devices will process personal
information of users and non-users alike, exacerbating privacy risks if not
designed and implemented in a privacy-positive manner.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">It is of great importance to embed privacy by design in
infrastructure, also, policies and standards early on will be critical to
ensure people’s rights to privacy are safeguarded in the next generation of immersive
internet.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;strong>Decentralised Finance&lt;/strong>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">The growing popularity of decentralized finance (“&lt;/span>&lt;strong style="font-size: 14px;">DeFi&lt;/strong>&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">”) and the
qualities of distributed ledger technology (“&lt;/span>&lt;strong>DLT&lt;/strong>&lt;span style="font-size: 14px;">”) that enable
transparent, permissionless and permanent processing beyond centralised control
structures also present clear challenges listed below for privacy and
compliance with data protection law.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;ul style="list-style-type: square;">&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">
 Organisations may use DeFi systems for a diverse range of
     transactions. Since anyone with access can inspect the chain and
     transactions, it is relatively simple for a bot or script to harvest
     information about transactions etc.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Blockchain transtactions may not involve disclosing certain
     categories of personal information that does not eliminate the possibility
     that people could be identified. This is because information recorded as
     part of blockchain transactions may be pseudonymised rather than strictly
     anonymous. The risk of re-identification increases with the volume of
     information stored on the blockchain.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">The decentralised nature of networks in the crypto-asset
     industry raises questions about who may be the data controller as well as storage
     limitation, rectification and erasure obligations may present particular
     challenges in current popular applications of the technology. People may struggle
     to exercise their rights because of the identify who the accountable party
     for data processing.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/li>&lt;/ul>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Fortunately, organizations are developing privacy-positive
capabilities, such as privacy mixers and zero-knowledge proofs, to address
these concerns. However, these solutions may also reduce the usefulness of the
service, so organizations must find a balance between privacy protection and
utility.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">Currently, DeFi might hold a tiny share of total financial services
markets. However, the potential for growth and the novel architecture
underpinning DeFi services may create important effects in people’s privacy, as
well as ownership and control of personal information in the near future.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">In decentralized technologies obligations relating to data
protection by design and default require organisations to implement privacy
standards and information rights in the systems and services they develop.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;strong>Conclusion&lt;/strong>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">The Report provided us with detailed information and aspects on which
new technologies will be inspected as well as insight on the privacy
expectations regarding applied technologies.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/p>&lt;p style="text-align: justify;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">ICO declares in the Report that following the publication of the
report into biometric futures in October 2022, second emerging technology
deepdive on neurotechnology in the first half of 2023 will also be published.&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;/span>&lt;span style="font-size: 14px;">&nbsp;&nbsp;&nbsp;&lt;/span>&lt;/span>&lt;/span>&lt;/p>

The Information Commissioner's Office released the Tech Horizons Report, which addresses the most significant technological developments for privacy in the next two to five years, as well as the current range of risks that may harm people's privacy and trust in these technologies.

ICO Published Tech Horizons Report

&lt;p class="MsoNormal" align="center" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">İtalyan Veri Koruma Otoritesi
        &lt;/span>&lt;strong style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">(“Otorite”)&lt;/strong>&lt;span style="font-family: Arial, Helvetica, sans-serif; font-size: 14px;">, kullanıcılarına “sanal bir arkadaş” sunma amacı olan yapay zekâ
        destekli chatbot Replika’nın veri işleme faaliyetlerini yasakladı. Eğer Replika
        tarafından 20 gün içerisinde karara uyulmazsa, 20 milyon Euro veya global
        cirosunun %4’ü kadar para cezasıyla karşı karşıya kalacak.&lt;/span>&lt;br>&lt;/p>

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">Otorite, verdiği kararda
        Replika’nın Avrupa Veri Koruma Genel Tüzüğü’nün (GDPR) şeffaflık ilkesine uygun
        veri işlemediğine, özellikle çocukların sözleşmelere taraf olmaya ehil bile değilken
        Replika’nın sözleşmenin yerine getirilmesi için gerekli olması hukuki nedenine
        dayanarak çocukların verilerinin işlenmesinin hukuka aykırı olduğuna karar
        vermiştir. &lt;/span>&lt;/p>

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">Kararda, Replika’nın
        uygulama içerisinde kaydolurken herhangi bir yaş doğrulaması yapmaması ve uygulamayı
        kullanan çocuklar için yaşlarına uygun olmayan cevaplar vermesi nedeniyle
        çocuklar için somut tehditler içerdiği belirtilmiştir. &lt;/span>&lt;/p>

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">Bu teknolojinin çocuklar
        için oluşturabileceği riskler konusunda endişeler dile getirilmekte. Bunlar,
        çocukların uygunsuz içeriğe maruz kalmasıyla ilgili endişelerden, etkileşimlere
        bağımlı hale gelmeleri, avatarlarını özelleştirmek için para harcamaya teşvik
        edilmeleri veya diğer ücretli içeriğe erişim elde edebilecekleri gibi daha
        genel endişelere kadar uzanıyor. Ancak Otorite, çocuk güvenliği konusunda resmi
        önlem alan ilk düzenleyici olarak görünmektedir.&lt;/span>&lt;/p>

İtalyan Veri Koruma Otoritesi, kullanıcılarına “sanal bir arkadaş” sunma amacı olan yapay zekâ destekli chatbot Replika’nın veri işleme faaliyetlerini yasakladı.

İtalyan Veri Koruma Kurulu Yapay Zekâ Destekli Chatbot Replika’nın Veri İşleme Faaliyetlerini Yasakladı

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; color: rgb(29, 27, 27); font-size: 14px;">&lt;span style="font-size: 14px;">The Italian Data
        Protection Authority (the "&lt;/span>&lt;strong>Authority&lt;/strong>&lt;span style="font-size: 14px;">") banned the data processing
        activities of Replica, an AI-powered chatbot app that offers a "virtual
        friend" experience to users. If Replica fails to comply with the
        Authority's order within 20 days, it may face a fine of up to €20 million or 4%
        of its global turnover.&lt;/span>&lt;/span>&lt;/p>

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(29, 27, 27);">The Authority found that
        Replica does not adhere to the transparency principle outlined in the European
        Data Protection General Regulation (GDPR) regarding the processing of personal
        data. In particularly, the legal basis for Replika's data processing, which
        relies on the performance of a contract, is invalid as children are not
        qualified to enter into such contracts.&lt;/span>&lt;/p>

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(29, 27, 27);">The decision also notes
        that Replika poses tangible threat to children. Replica lacks any age
        verification system during the registration process, and the chatbot's
        responses may not be appropriate for the children using the app.&lt;/span>&lt;/p>

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; line-height: 2; font-family: Calibri, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(29, 27, 27);">Concerns have been raised
        about the risks such technology might pose to children. These range from
        worries over kids being exposed to inappropriate content to more general
        concerns such as that they might get addicted to the interactions, be
        encouraged into spending money on customizing their avatars or to gain access
        to other paid content. But the Authority appears to the first regulator to take
        formal action over child safety.&lt;/span>&lt;/p>

The Italian Data         Protection Authority banned the data processing activities of Replica, an AI-powered chatbot app that offers a "virtual friend" experience to users.

Italian Data Protection Authority Bans Data Processing of AI-Powered Chatbot Replica

&lt;p class="MsoListParagraphCxSpFirst" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;span style="font-size: 14px;">The Information
        Commissioners Office (“&lt;/span>&lt;strong>ICO&lt;/strong>&lt;span style="font-size: 14px;">”) has published “Guidance on direct marketing using
        live calls” under The Privacy and Electronic Communications Regulations 2003
        (“&lt;/span>&lt;/span>&lt;strong style="font-size: 14px;">PECR&lt;/strong>&lt;span style="font-size: 14px;">”). The guide regulates the rules that must be followed under PECR if a
        live marketing call is made. The guide supports the use of live calls in
        marketing while protecting users from unwanted situations.&lt;/span>&lt;/span>&lt;/p>&lt;p class="MsoListParagraphCxSpFirst" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;br>&lt;/span>&lt;/span>&lt;/p>



&lt;p class="MsoListParagraphCxSpMiddle" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">PECR covers all
        types of live marketing calls. But calls, such as claims management service and
        live marketing calls for a pension scheme, are subject to stricter rules.&lt;/span>&lt;/p>&lt;p class="MsoListParagraphCxSpMiddle" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;br>&lt;/span>&lt;/p>



&lt;p class="MsoListParagraphCxSpMiddle" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">Although PECR does
        not use “live” calling terminologically, the term “live” call is used in the
        Guidelines to distinguish it from automated/automatic calls (systems that play recorded
        messages). In a live call, the person speaks with a person and not with a tape
        recording. The definition of direct marketing is taken from the Data Protection
        Act 2018 (“&lt;/span>&lt;strong>DPA 2018&lt;/strong>&lt;span style="font-size: 14px;">”). According to DPA 2018, direct marketing is defined as
        “the transmission (by any means) of advertising or marketing materials to
        specific individuals”. It includes direct marketing, commercial marketing,
        incentive (donation/election campaign) activities. The definition includes any
        form of communication involving live calling and marketing and does not include
        calls made for administrative or customer service purposes.&lt;/span>&lt;/span>&lt;/p>&lt;p class="MsoListParagraphCxSpMiddle" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;span style="font-size: 14px;">&lt;br>&lt;/span>&lt;/span>&lt;/p>



&lt;p class="MsoListParagraphCxSpMiddle" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">Generally, PECR
        rules apply to anyone who wishes to make a live call for marketing purposes
        without the request of the other party. At this point, the caller or promoter
        will be responsible. For example, if someone has asked someone else to make a
        live marketing call on their behalf, the caller and the person making the call
        will be responsible. &lt;/span>&lt;/p>&lt;p class="MsoListParagraphCxSpMiddle" style="margin: 0px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">&lt;br>&lt;/span>&lt;/p>



&lt;p class="MsoListParagraphCxSpLast" style="margin: 0px 0px 13px -1px; line-height: 1.5; font-family: Arial, sans-serif; text-align: justify; font-size: 15px;">&lt;span lang="EN-GB" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px;">Additionally, some
        of the live marketing calls may be covered by other regulations. For example,
        the Financial Conduct Authority has introduced some rules that prohibit sales
        made by calling random phone numbers from the directory. These rules and
        standards should also be looked at. &lt;/span>&lt;/p>

The Information Commissioners Office has published “Guidance on direct marketing using         live calls” under The Privacy and Electronic Communications Regulations 2003.

Guide to Direct Marketing Using Live Calls Published By ICO

&lt;p style="margin-right: 0px; margin-left: 0px; text-align: justify; line-height: 1.5;" times="" new="" roman",="" serif;="" text-align:="" justify;="" line-height:="" 1.5;="" font-size:="" 16px;"="">&lt;span lang="TR" style="font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(18, 17, 17);">TikTok uygulaması
        ile ilgili olarak açık rızanın 6698 sayılı Kişisel Verilerin Korunması Kanunu
        (“Kanun”) kapsamında usulüne uygun alınmadığı, kişisel verilerin elde edilmesi
        ve saklanması hususunda hukuka aykırılıkların bulunduğu ve yazılıma ait birçok
        güvenlik açığı olduğuna yönelik yer alan muhtelif haber ve şikayetlerden
        hareketle Kişisel Verileri Koruma Kurulu (“Kurul”) tarafından 6698 sayılı
        Kanun’un 15’inci maddesinin (1) numaralı fıkrası kapsamında resen
        gerçekleştirilen inceleme sonucunda;&lt;/span>&lt;/p>

&lt;ul style="list-style-type: square;">&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">Hassas yaş grubunda olan
        kullanıcıların verilerine erişilmesi kapsamında risklerin azaltılmasına yönelik
        gerekli tedbirlerin alınmadığı,&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">Uygulamayı kullanan 13 yaş altı
        çocukların kişisel bilgilerinin görüntülendiği ve uygun ebeveyn izni olmadan
        çocuklar hakkında veri toplandığı,&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">İnternet sitesinde yer alan
        Gizlilik Sözleşmesinin "belirli, açık ve meşru amaçlar için işlenme"
        ve "işlendikleri amaçla bağlantılı, sınırlı ve ölçülü olma"
        ilkelerine aykırı düzenlendiği,&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">Hizmet Koşullarının (Kullanım
        Şartları) kabulüne ilişkin onay alınırken ilgili metnin henüz Türkçe’ye
        çevrilmemesi sebebiyle kullanıcıların kullanım şartlarını tam olarak
        anlayamadan kabul etmesinin ihtimal dahilinde olduğu,&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">Gizlilik Politikasının, esasen
        aydınlatma yükümlülüğünü yerine getirmek için hazırlanmış bir metin olduğu,
        ancak açık rıza metni yerine de kullanıldığı, dolayısıyla, açık rıza şartına
        dayalı olarak gerçekleştirilen kişisel veri işleme faaliyetleri bakımından açık
        rızanın aydınlatma yükümlülüğünden ayrı olarak yerine getirilmesi şartının sağlanmadığı,&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">Profilleme amacıyla çerezler
        kullanılarak gerçekleştirilen kişisel veri işleme faaliyetine ilişkin olarak
        ilgili kişilerden açık rıza alınmadığı&lt;/span>&lt;/li>&lt;/ul>











&lt;p style="margin-right: 0px; margin-left: 0px; text-align: justify; line-height: 1.5;" times="" new="" roman",="" serif;="" text-align:="" justify;="" line-height:="" 1.5;="" font-size:="" 16px;"="">&lt;span lang="TR" style="font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(18, 17, 17);">tespit edilmiştir.&lt;/span>&lt;/p>

&lt;p style="margin-right: 0px; margin-left: 0px; text-align: justify; line-height: 1.5;" times="" new="" roman",="" serif;="" text-align:="" justify;="" line-height:="" 1.5;="" font-size:="" 16px;"="">&lt;span lang="TR" style="font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(18, 17, 17);">Kanun’un 12’nci
        maddesinin (1) numaralı fıkrasında yer alan kişisel verilerin hukuka aykırı
        olarak işlenmesini önlemek amacıyla uygun güvenlik düzeyini temin etmeye
        yönelik gerekli her türlü teknik ve idari tedbirleri almadığı tespit edilen
        Veri Sorumlusu hakkında &lt;strong>1.750.000 TL&lt;/strong> idari para cezası
        uygulanmasına ve &nbsp;‘‘İlgili kişilerin doğru bilgilendirilmesi adına Hizmet
        Koşullarının bir ay içerisinde Türkçeye çevrilmesi”, “İlgili kişilerin doğru
        bilgilendirilmesi için söz konusu Gizlilik Politikası metinlerinin üç ay
        içerisinde Kanuna uygun hale getirilmesi’’, ‘‘Gizlilik Politikasının, aydınlatma
        metni yerine kullanıldığı ve geçerli bir aydınlatmanın unsurlarını taşımadığı
        anlaşıldığından, Kanun’un 10'uncu maddesi ve Aydınlatma Yükümlülüğünün Yerine
        Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ hükümlerine uygun bir
        aydınlatma yapılması’’ hususunda talimatlandırılmasına karar verilmiştir.&lt;/span>&lt;/p>

&lt;p style="margin-right: 0px; margin-left: 0px; text-align: justify; line-height: 1.5;" times="" new="" roman",="" serif;="" text-align:="" justify;="" line-height:="" 1.5;="" font-size:="" 16px;"="">&lt;span lang="TR" style="font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(18, 17, 17);">Kararda aydınlatma
        yükümlülüğünün ihlali sebebi ile Kanun’un 18/1/a maddesi uyarınca idari para
        cezasına karar verilmemiş olup yalnızca talimatlandırma yoluna gidilmesi dikkat
        çekmektedir. &lt;/span>&lt;/p>

&lt;p class="MsoNormal" style="margin: 0px 0px 11px; font-family: Calibri, sans-serif; text-align: justify; line-height: 1.5; font-size: 15px;">&lt;span lang="TR" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(18, 17, 17);">Kurul’un kararı öncesinde de
        TikTok’un faaliyetlerine ilişkin uluslararası veri koruma otoritelerinin de
        kararları söz konusuydu;&lt;/span>&lt;/p>

&lt;ul style="list-style-type: square;">&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">&lt;span lang="TR" style="line-height: 115%; font-size: 14px;">Güney Kore İletişim Komisyonu,
        Temmuz 2020’de, 14 yaşından küçük kullanıcıların kişisel verilerinin ebeveyn
        izni olmaksızın toplandığı gerekçesiyle TikTok'a &lt;strong style="">186 milyon Won&lt;/strong> idari
        para cezası uygulanmasına karar vermiştir.&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">&lt;span lang="TR" style="line-height: 115%; font-size: 14px;">Hollanda Veri Koruma Otoritesi,
        Temmuz 2021’de, Tiktok’un 16 yaş altı kullanıcıların mahremiyetini ihlal ettiği
        gerekçesiyle &lt;strong>750.000 Euro&lt;/strong> idari para cezası uygulanmasına karar vermiştir.&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">&lt;span lang="TR" style="line-height: 115%; font-size: 14px;">ABD’de ise ulusal yasalara aykırı
        olarak 13 yaşından küçük kullanıcıların ebeveynlerinden izin almadan çeşitli
        kişisel bilgilerini toplaması sebebiyle &lt;strong style="">5.7 milyon Dolar&lt;/strong> idari para
        cezası uygulanmasına karar vermiştir.&lt;/span>&lt;/span>&lt;/li>&lt;li style="margin-left: 20px; text-align: justify; line-height: 1.5;">&lt;span style="font-family: Arial, Helvetica, sans-serif; color: rgb(18, 17, 17); font-size: 14px;">&lt;span lang="TR" style="line-height: 115%; font-size: 14px;">İngiltere Veri Koruma Otoritesi
        ICO’nun ise 13 yaş altı çocukların kişisel verilerinin işlenmesi, hukuka uygun
        aydınlatma yapılmamış olması ve hukuka uygunluk sebeplerinden yoksun olmasına
        rağmen özel nitelikli kişisel verilerin işlenmesi nedeniyle &lt;strong style="">27 milyon Pound&lt;/strong>
        cezaya karar verme olasılığı bulunmaktadır. &nbsp;&lt;/span>&lt;/span>&lt;/li>&lt;/ul>







&lt;p class="MsoNormal" style="margin: 0px 0px 11px; font-family: Calibri, sans-serif; text-align: justify; line-height: 1.5; font-size: 15px;">&lt;br>&lt;span lang="TR" style="line-height: 115%; font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(18, 17, 17);">Hukuka uygunluk sebepleri mevcut
        olmaksızın çerez kullanımı, gizlilik bildirimlerinin eksik veya hatalı
        yapılması, kullanıcılara aydınlatmanın eksik, açık olmayan ve belirsiz
        ifadelerle yapılması ile küçüklere uygun yasal dayanak bulunmaksızın hizmet
        sunulması sebepleriyle Tiktok'a çeşitli Veri Koruma Otoriteleri tarafından
        uygulanan cezalara bir yenisi, Kişisel Verileri Koruma Kurulu tarafından
        eklenmiş oldu.&lt;/span>&lt;/p>

&lt;p style="text-align: justify; line-height: 1.5;">&lt;span lang="TR" style="line-height: 107%; font-family: Arial, Helvetica, sans-serif; font-size: 14px; color: rgb(18, 17, 17);">Hem Kişisel Verileri Koruma Kurulu’nun hem de
    uluslararası veri koruma otoritelerinin kararlarını incelediğimizde özellikle küçük
    kullanıcılara ait kişisel veri işleme faaliyetlerine, buna ilişkin ebeveynlerin
    açık rızasının alınması konusuna ve hassas verilere erişimi engellemek amacıyla
    alınması gereken tedbirlere de değinilmiş olması, Veri Sorumlularının bu tür
    veri işleme faaliyetleri noktasında mevcut yükümlülüklerini ne derece yerine
    getirdiği sorusunu tekrar gündeme taşımıştır.&lt;/span>&lt;/p>

TikTok uygulaması ile ilgili olarak açık rızanın 6698 sayılı Kişisel Verilerin Korunması Kanunu         (“Kanun”) kapsamında usulüne uygun alınmadığı, kişisel verilerin elde edilmesi ve saklanması hususunda hukuka aykırılıkların bulunduğu ve yazılıma ait birçok güvenlik açığı olduğuna yönelik ...

Lawyers Ayşe Aybüke Çilingir

Ayşe Aybüke Çilingir

ICO Published Tech Horizons Report

İtalyan Veri Koruma Kurulu Yapay Zekâ Destekli Chatbot Replika’nın Veri İşleme Faaliyetlerini Yasakladı

Italian Data Protection Authority Bans Data Processing of AI-Powered Chatbot Replica

Guide to Direct Marketing Using Live Calls Published By ICO

Kişisel Verileri Koruma Kurulunun 2023/134 Sayılı Kararı Doğrultusunda Tiktok Hakkında 1.750.000 TL İdari Para Cezası Uygulanmasına Karar Verildi