TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
3.3 Rights and Obligations Under Applicable Data Regulation Due to the absence of a standalone regulation specifi - cally addressing the use of non-personal data, general obligations outlined in the DP Law apply in so far as these services involve processing of personal data (see 1.2 Rights and Obligations ). 3.4 Regulators and Enforcement As Türkiye currently lacks comprehensive data regula - tions beyond those pertaining to personal data pro - tection, there is no specific regulatory body solely tasked with enforcement in this area. However, when relevant actors process personal data, the DPA will be responsible for overseeing the process. That being said, sector-specific regulations may grant authority to certain regulatory bodies over specific data-related matters. Under Turkish law, there is no legislation explicitly governing the use of cookies, except for the Elec - tronic Communications Law (ECL), which applies only to electronic communications service providers. The ECL permits cookies for communication or if users are informed and give explicit consent. The DPA considers data collected through cookies as personal data, thus subject to the DP Law. The DPA issued the Guidelines on Cookie Applications (Cookie Guidelines) providing best-practice recommendations for data controllers, including cookie banners, consent management platforms, and a sample cookie policy. Cookie Guidelines is limited to the use of cookies and does not cover other tracking technologies such as Software Development Kits (SDKs) and device identi - fiers. However, as the DPA has not issued specific guidance on the latter and given their similar process - ing nature, the Cookie Guidelines may also serve as an important reference in terms of the DPA’s approach to tracking technologies other than cookies. 4. Sectoral Topics 4.1 Use of Cookies The Cookie Guidelines also refer to the ECL and provide two criteria for processing activities where
controllers rely on legitimate interest. Controllers are advised to perform a balancing test, weighing the indi - vidual’s rights and freedoms against the controller’s legitimate interests, taking into account whether: • cookies are essential for communication via elec - tronic communication networks; or • cookies are strictly necessary for information soci - ety services explicitly requested by the user. Moreover, the Cookie Guidelines include several rec - ommendations for situations where controllers obtain data subjects’ explicit consent for the use of cook - ies, for which an opt-in mechanism is required. For instance, using consent management platforms allow - ing data subjects to manage their preferences is cited as a good practice. However, since frequent requests may cause “consent fatigue”, consent reminders are advised to align with the cookie’s lifespan. Furthermore, consent obtained through cookie walls – where access to a website is conditioned on accept - ing cookies – is generally considered invalid if it pre - vents users from making a genuine choice. However, a cookie wall may be deemed acceptable on a case-by- case basis, provided that fair alternatives are offered to the user for accessing the service without compro - mising their free will. In cases where the use of cookies involves transfer - ring data abroad, controllers should also consider the requirements outlined in the DP Law (see 5.1 Restric- tions on International Data Transfers ). Special Considerations for Analytics Cookies The Cookie Guidelines classify cookies by duration, purpose and party. While these categories largely mir - ror EU practice, there is a key difference for analytics cookies; explicit consent may not be required for first- party analytics cookies, provided that: • their use is limited to measuring site or applica - tion’s target audience; • personal data collected through cookies – which are not strictly required for the purpose of process - ing – is anonymised; • the personal data collected through cookies is only used for anonymous statistics;
520 CHAMBERS.COM
Powered by FlippingBook