Two-Minute Recap of Recent Developments in Turkish Personal Data Protection Law – August 2023

Newly announced: Google now has permission for cross-border data transfers

In August, the DPA granted approval for Google Reklamcılık ve Pazarlama Limited Şirketi (“Google”) to transfer personal data abroad. The decision, dated 17 August 2023, came after a thorough evaluation of Google’s application with written undertaking for cross-border personal data transfers.

Healthcare institutions’ activities based on explicit consent under scrutiny

On 14 August, the DPA published two violation decisions concerning the processing of personal data by healthcare institutions based on the explicit consent of data subjects.

Key points addressed within the decisions include:

In the first decision, the DPA found that a private healthcare institution’s activity was unlawful, ruling that they had engaged in promotional activities by sharing patients’ data on social media, despite having the explicit consent of the patients.

In its assessment, the DPA emphasised that data processing activities must align with legal regulations in the broadest sense to be considered legitimate under the principle of processing data for specific, clear, and lawful purposes. Although the healthcare institution claimed that they can carry out informational and promotional activity and that it is legitimate, the DPA stated that to consider an activity as legitimate, it should be in line with the applicable legislation. In this regard, the DPA stated that, despite the fact that the healthcare institution had acquired patients’ explicit consent, the activity in the concrete case exceeded informational and promotional activities permitted by Turkish law. Therefore, this processing of personal data was found unlawful, and as a result, the data controller faced an administrative fine of TRY 250,000 (approx. EUR 8,450).

In the second decision, the DPA reiterated that explicit consent should not be conditional. In this case, a private healthcare institution required patients seeking an appointment to explicitly consent to marketing activities. The DPA ruled that this condition violated the element of “free will”. As a result, an administrative fine of TRY 300,000 (approx. EUR 10,140) was imposed on the healthcare institution.

For more details on these decisions, you can access our article summarising them here.

The Board announced the following data breach notification in August:

Data Controller

Affected Data Subjects

Affected Personal Data

Number of Data Subjects

Vodatech Bilişim Proje Danışmanlık Sanayi ve DışTicaret

Employees, Family Relatives of Employees, Suppliers, Business Partners, Customer Employees and Employee Candidates

Identity, Communication, Personnel Information, Finance, Professional Experience Data

9,746

Diler Holding and Below Group Companies

·AtlasEnerjiÜretim

·BodovaTurizmYatçılıkSan.veTic.

·DilerDemirÇelikEndüstriveTicaret

·DilerDenizcilikveTic.

·DilerElektrikÜretim

·DilerDışTicaret

·EsmDenizcilikveTicaret

·EtiToprakEndüstrisiveTicaret

·RenarBitkiselÜretimSanayiveTicaret

·ResaDemirSanayiveTicaret

·YazıcıDemirÇelikSan.veTurizmTic.

Employees and Users

Identity, Communication, Personnel Information, Legal Transaction, Customer Transaction, Physical Place Security, Transaction Security, Risk Management, Finance, Professional Experience, Marketing Data and Audio and Visual Recordings

1,200

UPS Hızlı Kargo Taşımacılığı

Customers