In its decision numbered 2022/790, the Personal Data Protection Board addressed a complaint concerning the transfer of a data subject's health data to a public institution for an ongoing administrative lawsuit. The complaint alleged that the transfer of the data subject's health data from a university hospital to the public institution constituted an unlawful processing of personal data. The Board determined that the transfer violated data protection principles and instructed the data controller to take corrective actions, including disciplinary measures and data destruction. The data subject was also advised to apply for correction through the provincial health directorate. The Board emphasized the importance of timely response to data subject requests.

The Personal Data Protection Board assessed a complaint about a marketing company processing a child's personal data without explicit parental consent. The company's self-employed entrepreneur sent a promotional brochure to an 8-year-old child, allegedly processing the child's data unlawfully. The Board clarified that the entrepreneur acted independently as a data controller, and the company had no involvement in the data processing. The argument that personal data was provided by the data subject was rejected, as it didn't meet the exception provision. Processing the child's name and address for marketing purposes didn't fulfill the conditions in the law, resulting in a fine. The company was instructed to obtain explicit consent and comply with data protection regulations.

In its decision, the Personal Data Protection Board addressed a complaint regarding the unauthorized transfer of personal data from a bank to an insurance company. The complaint alleged that the bank shared the data subject's phone number without explicit consent. The Board determined that the transfer violated the Law on the Protection of Personal Data and the principle of obtaining explicit consent. The data controller failed to provide evidence of informed consent or a lawful basis for the transfer. Sharing personal data without the customer's instruction, even with explicit consent, is prohibited. As a result, the Board imposed a fine on the bank for breaching data protection obligations.

The Personal Data Protection Board evaluated a complaint about the employer continuing to process the personal data of the data subject after the termination of their employment contract. The complaint stated that the data controller company used the data subject's photos and phone number for promotional purposes and communication with courier companies after the contract ended. The Board found that using the photos for advertising purposes and processing the phone number without proper notification violated the principle of accuracy and up-to-date information. Consequently, an administrative fine of TRY 250,000 was imposed on the data controller, and they were instructed to delete the unlawfully processed data and provide a report to the data subject's representative.

The Personal Data Protection Board has imposed an administrative fine of TRY 950.000 (approx. EUR 44.246) on a technology company for transferring personal data abroad without explicit consent from the data subjects, and not responding to their request within the legally specified period. The board stated that the company violated the Law on the Protection of Personal Data and failed to take necessary technical and administrative measures to ensure appropriate security level. Moreover, the company did not submit a commitment to provide adequate protection in the country to which the transfer would be made. The Board instructed the company to make necessary arrangements and inform the Board.

The Personal Data Protection Board evaluated the complaint application about sharing the photos taken during surgery of the data subject and published on the social media account by a doctor who works in the data controller hospital in its decision dated 29.06.2022 and numbered 2022/630.

The Personal Data Protection Board evaluated the complaint application regarding sending the order information of a third party from the e-commerce website which is the data controller to the data subject in its decision dated 03.08.2022 and numbered 2022/774.

The Personal Data Protection Board evaluated the complaint application regarding the failure of the data controller to provide the privacy policy and explicit consent wording for cookies on the website of a gaming platform in its decision dated 23.12.2022 and numbered 2022/1358.

Bilgi Teknolojileri ve İletişim Kurumu’nun “Sosyal Ağ Sağlayıcı Hakkında Usul ve Esaslar”ına ilişkin yeni kararı, 1 Nisan 2023 tarihinde Resmi Gazete’de yayımlanarak yürürlüğe girmiştir.

The new decision of the Information Technologies and Communication Authority on the “Procedures and Principles About Social Network Provider” was published on the Official Gazette and entered into force on April 1, 2023.

The Personal Data Protection Board in Turkey has published the lower and upper limits of the administrative fines that may be imposed for violating the Law on Protection of Personal Data No. 6698 in 2023. These administrative fines are regulated in Article 18 "Misdemeanors" of the DPL, and apply to those who fail to fulfill their obligations, including the obligation to inform and the obligations related to data security. The minimum and maximum amounts of the fines are determined by the DPL and updated annually in line with the revaluation rate, and the fines for 2023 have been published by the Personal Data Protection Authority.

The Regulation on Electronic Commerce Intermediary Service Providers and Electronic Commerce Service Providers has been published to ensure the development of electronic commerce and establish an effective and fair competition environment. One of the significant amendments to the regulation is the section on the violation of intellectual and industrial property rights. The regulation aims to provide quick results for the protection of intellectual and industrial rights by obligating e-commerce platforms to remove the product subject to the complaint without investigation, thereby taking an active role in protecting intellectual and industrial rights.