TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
• capital markets institutions; and • financial leasing, factoring, and finance companies. Electronic Communications Providers In principle, electronic communications providers cannot transfer traffic and location data abroad, for national security reasons. In certain cases, such data may be transferred abroad by obtaining the explicit consent of data subjects. Specific requirements for obtaining consent from users are further regulated in secondary legislation. For instance, in cases where traffic and location data will be transferred, users must be informed about the scope of the data to be transferred, the name and address of the recipient party, the purpose and dura - tion of the transfer, and, if the third party is located abroad, the name of the country to which the data will be transferred, at the time of obtaining their consent. In 2019, the Information and Communication Technol - ogy Authority (ICTA) mandated that all infrastructure, systems, and storage units related to eSIM technolo - gies, including eSIM subscription management, must be set up in Türkiye either by operators authorised in Türkiye or by third parties designated by the opera - tors, with the operator bearing full responsibility. Addi - tionally, any data generated through eSIM technolo - SNPs with daily access exceeding one million must implement the necessary measures to ensure that the data of their Turkish users is retained within Türkiye. The ICTA further emphasised that priority should be given to storing essential user data, along with any other data specified. Commercial Electronic Message Management System Integrators The Communique on Commercial Electronic Mes - sage Management System Integrators mandates that authorisation from the Ministry of Trade is required to act as an integrator for service providers in register - ing approvals and rejections of marketing communi - cations in the MMS, or to carry out these transactions through the MMS. The communique stipulates that the information processing system used in integra - gies must be stored in Türkiye. Social Network Providers (SNPs)
tor services, including software, hardware, and server infrastructure, must be located within a local data - base. Critical Infrastructure Service Providers The Decree on Information and Communication Security Measures issued by the Presidency of Tür - kiye (Presidency Decree), sets specific measures to mitigate security risks, particularly for critical data that could jeopardise national security or public order if compromised. It provides an obligation to store criti - cal data (eg, population, health, and communication records, genetic and biometric data) securely. The Presidency Decree applies not only to businesses providing critical infrastructure services (eg, energy, electronic communications, banking, transportation) but also to public institutions and organisations. It stipulates that data from public institutions must not be stored in cloud services unless hosted in the institutions’ own private systems or with local service providers under their control. 5.4 Blocking Statutes Türkiye does not have specific “blocking” statutes, but there are general statutory provisions to prevent the disclosure of matters relating to national interests. 5.5 Recent Developments Following the most recent amendments to the DP Law, the DPA has made efforts to clarify the recently amended international personal data transfer regime with the Guidelines on Transfers Abroad and the announcement on the “Key Considerations for Stand - ard Contracts to be Used in the Transfer of Personal Data Abroad”. The DPA has recently made an announcement regard - ing the use of foreign messaging applications in public institutions. The DPA emphasised that official docu - ments containing confidential or critical data should not be shared through such applications, consider - ing that these applications do not have data centres within the country. The DPA has also announced that an agreement (not qualifying as an international treaty) between the Min -
526 CHAMBERS.COM
Powered by FlippingBook