TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
cal infrastructure operators. In addition, the DP Law imposed obligations regarding the security of person - al data, and certain sector-specific regulations also contained cybersecurity provisions. However, these rules did not establish a comprehensive cybersecurity regime. The Cybersecurity Law therefore functions as an overarching framework, and secondary legislation is expected to regulate its implementation further. The Cybersecurity Law broadly applies to public institutions, private entities, real persons, and other organisations operating in cyberspace. It grants the Cybersecurity Presidency extensive supervisory pow - ers and imposes several obligations on organisations, including co-operation with audits, implementation of cybersecurity measures, and notification of cyberse - curity incidents, with administrative fines and criminal sanctions introduced for non-compliance. Turkish Criminal Law Certain actions that violate the protection of personal data are defined as crimes in the Turkish Criminal Law (“TCrC”). The TCrC also outlines criminal sanctions for these violations: • unlawful recording of personal data is subject to imprisonment of one to three years; • unlawful transfer, publication, or acquisition of personal data is subject to imprisonment of two to four years – if these are realised by exploiting the advantages of a profession or art, such actions are subject to imprisonment of three to six years; and • failure to destroy personal data after the retention period set forth in the law has passed is subject to imprisonment of two years. The investigation may commence without requiring a complaint. There is no established jurisprudence on how criminal sanctions will be harmonised with the DP Law. Turkish Civil Law and the Turkish Code of Obligations Personal data is considered a part of personality under Turkish law; as such, it is also protected under the protection of personality rights in the Turkish Civil Law (TCiC). Therefore, an individual whose right to
the protection of personal data is violated may file a lawsuit before civil courts. General provisions of the Turkish Code of Obligation (TCO) may also apply in cases of breach of an obliga - tion, particularly when it comes to liability for dam - ages and compensation for harm caused by violating contractual or non-contractual obligations. Per the TCiC and the TCO, data subjects can not only seek compensation but also ask courts to: • prevent a threatened infringement; • cease an existing infringement; and/or • make a declaration that the infringement is unlaw - ful. Other There are also sector-specific regulations governing the processing of personal data in areas such as tele - communications, banking, electronic payment, health, and education. It is important to consider these legislations, as the DP Law specifies that provisions in other laws regarding the deletion, destruction, or anonymisation, or transfer of personal data, are reserved. 1.2 Rights and Obligations General Principles and Data Subject Rights Personal data processing is governed by the princi - ples of lawfulness, fairness, accuracy, and being up to date. Processing must be for specific, explicit, and legitimate purposes, remaining relevant, limited, and proportionate to the intended use. Under the DP Law, data subjects have the right to learn whether their per - sonal data is processed, obtain information about any such processing, its purposes, and the third parties to whom the data is transferred, to request the rec - tification or deletion of their personal data and the notification of such actions to third parties, to object to decisions based solely on automated processing, and to claim compensation for damages arising from unlawful processing. Obligations established by the DP Law are imposed on controllers, who determine the purpose and means of processing personal data. Key obligations include;
513 CHAMBERS.COM
Powered by FlippingBook