The Turkish Personal Data Protection Authority (“DPA“) published the summary of its decision evaluating the cross-border transfer of personal data by a data controller relying on Convention 108. The DPA also evaluated the relationship between the restrictions under the Law No. 6698 on the Protection of Personal Data (“DPL“) regarding cross-border transfers and the legal status of the Convention 108.
The DPA’s full announcement is available online here (in Turkish).
What Does the Decision Say?
The DPA provided detailed explanations and comments as part of its evaluation on the matter. The key takeaways from the decision may be summarized as follows:
The DPA confirmed once more that a cross-border transfer to an “unsafe” country without the explicit consent of the data subject is only possible if one of the legal bases for processing personal data under the DPL exists, the parties sign a commitment letter and obtain the DPA’s approval regarding the transfer. Considering that currently the DPA has not yet announced any country as “safe” and does not appear able to conclude the approval procedure within short time periods, the only option left for data controllers in the short term is obtaining explicit consent for cross-border transfers. The DPA recommends that data controllers refrain from relying on consent to the extent possible. Moreover, there are practical and economic concerns and obstacles in daily economic life with respect to implementing a consent mechanism, which may become redundant after a while. In that regard, one might argue that the issues the data controllers face with respect to cross-border transfers will likely continue to take up the time and costs for all parties concerned. In any case, the decision is a significant development as it clarifies the status of the Convention 108 with respect to data privacy requirements by confirming that it does not provide a valid mechanism for cross-border transfer of personal data as an alternative to the mechanisms under the DPL.
Please stay up to date with further developments through the Esin Attorney Partnership Coronavirus Helpdesk.