TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
• Registration to the Registry of Controllers (VER - BIS): Controllers meeting specific criteria must register with the VERBIS. Those obliged control - lers must also maintain a data processing inven - tory and implement a Personal Data Retention and Destruction Policy. Additionally, they must desig - nate a “contact person” responsible for submitting information to VERBIS and facilitating communica - tion with the DPA. • Privacy Notices: Controllers must provide data subjects with clear notices detailing the processing activity. • Technical and Administrative Measures: Control - lers must implement appropriate organisational and technical safeguards to prevent unauthorised access and unlawful processing. • Request Management: Controllers must respond to data subject requests within 30 days. • Breach Notification: Any personal data breach must be notified to the DPA without any delay and within 72 hours of becoming aware of the breach, where possible. Affected individuals must also be informed promptly. • Processor Oversight: Controllers are jointly respon - sible for ensuring that processors implement the necessary technical and administrative measures while processing data on their behalf. 1.3 Special Categories of Personal Data Special categories of personal data are defined in DP Law as follows: data relating to race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership of asso - ciations, foundations or trade unions, data concerning health, sexual life, criminal convictions and security measures, and biometric and genetic data. The processing of special categories of personal data is governed by Article 6 of the DP Law and secondary regulations issued by the DPA. The processing conditions specified in Article 6 of DP
• being mandatory to protect the life or physical integrity of a person who is physically unable to give consent; • being made public by the data subject; • being mandatory for the establishment, exercise, or protection of a right; • being mandatory for the fulfilment of legal obliga - tions in the fields of employment, occupational health and safety, social security, or social assis - tance; • being mandatory for activities carried out by foun - dations, associations, or other non-profit organisa - tions for their members, provided the data is not disclosed to third parties; and • being mandatory for medical diagnosis, treatment, care services, or the planning and management of health services and financing. Controllers must also comply with the DPA’s deci - sion, setting out specific technical and administrative measures for the processing of special categories of personal data. DP Law does not foresee a specific regime for the pro - cessing of minors’ personal data; however, the DPA occasionally publishes guidelines and materials aimed at raising awareness. 1.4 Processing of Personal Data for Research and Development Purposes Unlike the GDPR, the DP Law does not provide a specific legal basis for processing and/or anonymis - ing health data for scientific purposes. Under the DP Law, (i) the processing of personal data for purposes such as research, planning, and statistics through anonymisation, and (ii) the processing of personal data for scientific purposes, provided that it does not violate national defence, national security, public security, public order, economic security, the right to privacy, or personality rights, and does not constitute a criminal offence, are completely exempt from the application of the DP Law. Moreover, according to the By-law on Personal Health Data, health data may be used for scientific purposes when the exemptions in the DP Law are triggered. However, since (i) the DP Law does not define scien - tific research, and (ii) the DPA has not adopted a clear
Law are as follows: • explicit consent; • being explicitly prescribed by law;
514 CHAMBERS.COM
Powered by FlippingBook