According to the 8th Judicial Package, the law amending the Law on Protection of Personal Data No. 6698 was published in today’s Official Gazette.

Law No. 32487 dated 12 March 2024, published in the Official Gazette, regulates amendments to the Code of Criminal Procedure and Some Laws. Within the scope of Articles 33-36 of the relevant law, changes to Law No. 6698 on Protection of Personal Data (“PPDL”) are envisaged.

The amendments under the PPDL will take effect on 1 June 2024.

The approach that explicit consent is the primary option for transferring personal data abroad has been removed by the proposed amendments, transforming explicit consent into a possibility that can be used for temporary or momentary transfers of personal data.

Qualification decisions by the Board may be issued not only for countries but also for sectors within the country or international organizations. A fundamental change regarding the main options for transferring personal data is the removal of the requirement for Board approval for standard contracts to be signed. Additionally, exceptional cases for the temporary or momentary transfer of personal data have also been proposed within the changes.

The proposed changes are considered to significantly address the issues encountered in the practice of transferring personal data abroad and eliminate the obligation to rely on explicit consent.

With the proposed amendment, an expansion is suggested in the processing conditions of special categories of personal data, including the addition of new processing conditions to the PPDL such as being expressly provided by laws, being impossible in practice, being made public by the data subject, being mandatory for the establishment, exercise, or protection of a right, fulfilling obligations such as employment, occupational health and safety, and establishing relationships with members of non-profit organizations such as associations and foundations.

It is evaluated that the mentioned amendment will significantly reduce the situations where explicit consent is required for the processing of special categories of personal data, especially in the context of employee recruitment processes.

According to the proposed amendment to the PPDL, administrative fines ranging from 50.000,00 TL to 1.000.000,00 TL are envisaged if the standard contracts to be signed for the transfer of personal data abroad are not reported to the Authority within five business days from the date of signature. As there will be no increase in these amounts in line with the revaluation rate, the amounts are considered relatively low compared to other fines.

The proposed changes include data processors as well as data controllers as the subjects of administrative fines. Additionally, administrative courts, rather than criminal peace judgeships, are designated as the appeal authorities against administrative fines.