TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
Civil Orders A data subject who suffers damage due to the unlaw - ful processing of their personal data under the DP Law has the right to seek compensation by applying to the competent civil court. Criminal Orders The TCrC governs criminal liability for data-related offences. Under the TCrC, unlawful recording of per - sonal data is punishable by imprisonment from one to three years. Article 136 stipulates that any individual who unlawfully provides, disseminates, or obtains personal data shall face a prison sentence of two to four years. Article 138 addresses the failure to destroy personal data; if a person responsible for data man - agement fails to delete or anonymise personal data despite the expiry of legally mandated retention peri - ods, they are subject to imprisonment for one to two years. Enforcement Under the Cybersecurity Law The Cybersecurity Presidency is still being established and has not yet initiated any enforcement actions. However, according to the Cybersecurity Law, the Cybersecurity Presidency is entitled to conduct on- site inspections, request information and technical materials, and examine systems; in certain cases, searches, copying, and seizure require a judge’s deci - sion or, in urgent cases, a prosecutor’s written order, subject to prompt judicial approval. Administrative fine decisions may be challenged before the administra - tive courts. The law does not provide a settlement mechanism. Sanctions include both administrative fines and crimi - nal penalties. Administrative fines apply, for failing to report vulnerabilities or cyber incidents, failing to meet procurement/certification obligations, and obstructing audits, among others; in some cases, fines for com - panies may reach up to 5% of annual gross sales. Criminal sanctions include imprisonment and judicial fines for withholding requested information, operating without required approvals, breaching confidentiality, unlawfully disclosing leaked data, spreading false leak claims, carrying out cyber-attacks, or abusing statu - tory powers. Penalties are generally shaped by the nature of the breach, repetition, any benefit gained, or damage caused, turnover where relevant, and aggra -
• failure to notify the DPA within five business days following the signature of the standard contracts (SCCs) (between TRY90,308 and TRY1,806,177). Unlike other failures stipulated in the DP Law where only the controller is responsible, both controllers and processors can be held liable for failure to notify the DPA regarding SCCs. The DPA must consider the severity of the breach, the fault of the breaching party, and its economic condi - tion. Administrative Orders The DPA may also order controllers to bring their pro - cessing activities into compliance with the DP Law. When the DPA issues such an order, this decision must be implemented without any delay and, at the latest, within 30 days upon receipt of the notification by the controller. The DPA is also entitled to cease certain personal data processing activities or transfers abroad if it finds that such processing activities result in damages that are difficult or impossible to compensate for, and if the act is clearly unlawful. Appeal Mechanisms Controllers have the right to appeal against the DPA’s decisions. They may object to such decisions before the administrative courts within 60 days of receiving the decision. The decisions of the administrative courts can be appealed to the Regional Administrative Courts, and the decisions of the Regional Administrative Courts can be further appealed to the Council of State, pro - vided that the administrative fine exceeds the appli - cable thresholds. However, if the DPA’s decision includes only an administrative measure rather than an administra- tive fine, decisions of both the administrative courts and Regional Administrative Courts can be appealed, regardless of the relevant minimum thresholds.
517 CHAMBERS.COM
Powered by FlippingBook