INFORMATION NOTE ON THE AMENDMENT OF SOME ARTICLES OF THE PERSONAL DATA PROTECTION LAW
I. INTRODUCTION
The law amending the Law No. 6698 on the Protection of Personal Data within the scope of the 8th Judicial Package was published in today’s Official Gazette.
The “Law on Amendments to the Code of Criminal Procedure and Certain Laws” was published in the Official Gazette dated March 12, 2024 and numbered 32487, and amendments are envisaged in the Law No. 6698 on the Protection of Personal Data (“KVKK”) within the scope of Articles 33-36 of the relevant law.
The amendments within the scope of KVKK will enter into force on June 1, 2024.
12 CHANGES REGARDING THE TRANSFER OF PERSONAL DATA ABROAD
The approach of explicit consent being the main possibility for transferring personal data abroad has been removed with the proposed changes and explicit consent has been transformed into a possibility that can be used in temporary or instantaneous personal data transfers.
The Board’s adequacy decisions can be made for sectors within the country or international organizations as well as countries. The fundamental change regarding the main possibilities for transferring personal data is the removal of the Board’s permission requirement for standard contracts to be signed. In addition, exceptional cases regarding the temporary or instantaneous transfer of personal data have been proposed within the changes.
It is evaluated that the proposed changes will largely solve the problems experienced in practice regarding the transfer of personal data abroad and eliminate the obligation to rely on explicit consent.
13 CHANGES REGARDING THE PROCESSING OF SPECIAL NATURED PERSONAL DATA
With the amendment proposal, it is suggested that the processing conditions of special quality personal data will be expanded and new processing conditions such as being foreseen in the laws, actual impossibility, publicization, being mandatory for the establishment, exercise or protection of a right, fulfillment of obligations such as employment, occupational health and safety, and establishing relations with members of non-profit organizations such as associations and foundations will be added to the KVKK.
It is assessed that the aforementioned amendment will significantly reduce the situations where special quality data processing requires explicit consent, especially in employee employment processes.
14 CHANGES REGARDING SANCTIONS ON PERSONAL DATA
In case of failure to notify the Institution within five business days from the date of signature of standard contracts to be signed regarding the transfer of personal data abroad to the KVKK, an administrative fine between TL 50,000.00 and TL 1,000,000.00 has been foreseen. Since the revaluation rate will not be increased for the amounts in question, it is assessed that the amounts are kept low compared to other fines.
With the proposed changes, data processors have been added to the addressees of administrative fines in addition to data controllers. In addition, administrative courts have been determined as the court of appeal against administrative fines instead of criminal courts of peace.
