Recent Developments
On 1 April 2023, the Information Technologies and Communications Authority (ITCA) published decision no. 2023/DK-İD/119, dated 28 March 2023, regarding the new set of Principles and Procedures for Social Network Providers (“New Principles and Procedures“) in the Official Gazette no. 32150. The New Principles and Procedures provide details and clarification on the amendments to the Law on the Regulation of Internet Publications and Prevention of Crimes Committed through these Publications No. 5651 (“Internet Law“), which was adopted on 13 October 2022. The New Principles and Procedures are available online here (in Turkish).
What’s new?
The ITCA’s New Principles and Procedures is an updated version of the ITCA’s previous Principles and Procedures for Social Network Providers dated 2 October 2020. The New Principles and Procedures mainly reiterate the ITCA’s position regarding the new amendments to the Internet Law in October 2022, but also provide further clarifications on some of the requirements therein.
1. Scope
The New Principles and Procedures clarify the scope of social network provider regulations. In this regard, the following providers will be out of scope:
- Persons that publish content for the purpose of social interaction that is only in a limited space on the platform (i.e., limited social interaction functionality)
- Platforms, such as personal websites, e-commerce platforms and news websites, that provide a social interaction functionality as a secondary or an ancillary service.
2. New Requirements
Requirements* | Penalty for non-compliance** |
Representative: The New Principles and Procedures initially reiterate the representative requirements for social network providers (e.g., “1 million daily access” requirement for appointing a representative as real person/legal entity and “10 million daily access” requirement for establishing a branch in the form of an equity company). The representative of a social network provider with more than 10 million daily accesses has full technical, administrative, legal, and financial liability for social network provider’s compliance. Incorporation requirements ITCA states that the entity that meets the following requirements is deemed as the representative:
Documentation attesting the above and the following documents must also be submitted to the ITCA:
Additionally, if the representative is a real person where the social network provider’s daily access from Türkiye does not exceed 10 million, documents showing that the representative is a Turkish citizen and resident in Türkiye must be submitted to the ITCA. Any changes to the above documentation or information must be notified to the ITCA immediately and no later than 72 hours. Duties of the representative The representative has the following duties:
Other requirements are as follows:
*Having a registered email address (i.e., KEP address) was not a regulatory requirement for representatives previously. It appears that this was introduced to facilitate the delivery of notifications to the representative. | Failure to comply with representative requirement are as follows (sanctions are implemented on a stage-by-stage basis):
*If the social network provider fulfills the representative requirement, only one-quarter of the administrative fines will be collected. |
Response to user requests: As per the Internet Law, social network providers are required to respond to the requests of users under Article 9 and 9/A of the Internet Law within 48 hours. The New Principles and Procedures indicate that the social network providers must facilitate the receipt of the individual applications. Accordingly, users should be able to send their requests in Turkish language, and social network providers must respond to such requests in Turkish. | Administrative fine of TRY 5,000,000 (approx. USD 260,000) *Upon the complaint of a user to the ITCA, the ITCA evaluates whether the social network provider is complying with its requirements to respond to users. The ITCA evaluates the user complaints collectively during the semi-annual (transparency) report periods. In its evaluation, the ITCA takes into account whether the social network provider does the following:
|
Semi-annual (transparency) reports: The New Principles and Procedures set out that the reports must include the following additional information:
The report to be prepared on the individual applications (i.e., Article 9 and 9/A requests) must also be published on the social network provider’s website without revealing any personal data. In addition, the ITCA states that social network providers must comply with accountability principles and submit any necessary information and documentation as requested by the ITCA to ensure transparency. | Administrative fine of TRY 10,000,000 (approx. USD 520,000) |
Advertisement library: In line with the amendments to the Internet Law, the social network providers are now required to prepare an advertisement library and provide information on this in the semi-annual reports. As per the New Principles and Procedures, the advertisement library must include the following:
The advertisement library must be easily accessible on the social network provider’s website. | Administrative fine of TRY 10,000,000 (approx. USD 520,000) (in connection with the transparency report requirements) |
Disclosure of user data to authorities: The New Principles and Procedures re-establish that the social network provider’s representative must provide the information requested by public prosecutor’s offices and courts during legal proceedings for the following offences:
The ITCA clarifies that the representative must directly respond to user data requests related to the above offences. | The public prosecutor’s office or court may apply to the Ankara Judgeship of Peace to request an internet bandwidth reduction of up to 90%. The internet bandwidth reduction order is notified to the ITCA (who subsequently notifies the access providers). Access providers should execute the order promptly and no later than four hours. If social network providers comply with the user data/information request, the internet bandwidth reduction order is revoked. |
Data localization: As per the Internet Law, social network providers must store Turkish users’ data within Türkiye. The New Principles and Procedures clarify that the basic user information and information that may be required by the ITCA must be prioritized during the exercise of the data localization requirement. | Administrative fine up to 3% of the previous calendar year’s global turnover |
Services designed for children: In line with the amendments to the Internet Law, social network providers must take the necessary measures for providing services dedicated to/designed for children. The New Principles and Procedures clarifies that social network providers must take into account the following during the display of content, advertisements and provision of services to children:
| Administrative fine up to 3% of the previous calendar year’s global turnover |
Protection of user rights: The New Principles and Procedures provide further requirements regarding the protection of user rights:
| Administrative fine up to 3% of the previous calendar year’s global turnover |
Establishment of an application mechanism: As per the Internet Law, social network providers are obliged to establish an effective application mechanism in cooperation with the ITCA for the removal of hashtags and featured content through a warning method. The New Principles and Procedures state that the social network providers must inform the ITCA regarding this mechanism as part of semi-annual reports. | Liability for the content, in case of a failure to take down the content promptly and at the latest within four hours upon the notification of the illegal content |
Content risking the life and safety of users: In line with the amendments to the Internet Law, if social network providers become aware of content that risks life and property of individuals that is also a case of urgency, it must notify authorized law enforcement authorities of the content and the content provider (i.e., user). | Administrative fine up to 3% of the previous calendar year’s global turnover |
ITCA’s information request authority: In line with the Internet Law, the New Principles and Procedures regulate that the ITCA is authorized to request from a social network provider, all explanations relating to the social network provider’s compliance with the Internet Law, including its corporate structure, information systems, algorithms, data processing mechanisms and commercial stance (tr. ticari tutum). Social network providers must provide the requested information and documentation within no later than three months. | Administrative fine up to 3% of the previous calendar year’s global turnover |
Crisis management plan: As per the Internet Law, the social network providers are required to prepare a crisis management plan. The New Principles and Procedures state that the ITCA may inform the social network providers regarding the aspects of preparation and disclosure of the crisis management plan. | Administrative fine up to 3% of the previous calendar year’s global turnover |
Content takedown: The New Principles and Procedures reiterates the measures in the case of non-compliance and states the following:
| Failure to comply with the ITCA’s content takedown orders (e.g., takedown orders on the basis of Articles 8 or 8/A of the Internet Law) will result in the following: 1. Punitive fine of up to TRY 5,000,000 (approx. USD 260,000) or an administrative fine of up to TRY 1,000,000 (approx. USD 50,000) 2. The ITCA can issue an advertisement ban for up to six months (the advertisement ban is not automatically lifted following compliance with the ITCA order) 3. The ITCA can request from the judgeship of peace to order an internet bandwidth reduction by 50% (irrespective of the advertisement ban) 4. Internet bandwidth reduction by 90% for failure to comply within 30 days of the initial internet bandwidth reduction decision |
*The summary focuses on the new and/or clarified provisions in the New Principles and Procedures.
** The administrative fines are subject to increase based on the revaluation rate of the previous year.
3. Additional Provisions
Failure to comply with administrative fines: In cases where the social network provider fails to pay administrative fines more than once in a year, an advertisement ban for up to six months may be applicable.
On-site inspection: The ITCA is authorized to conduct on-site inspections of a social network provider’s compliance with the Internet Law at all of the social network provider’s facilities.
Requests related to number of daily access: A social network provider may request the ITCA to assess the situation where its daily access from Türkiye is consistently below 1 million or 10 million. The ITCA will notify the social network provider if the request is approved. However, if the ITCA determines that daily access from Türkiye exceeds the threshold again, it will notify the social network provider in this respect.
Entry in force: The New Principles and Procedures entered into force on the date of publication, 1 April 2023.
Conclusion
The New Principles and Procedures, in line with the amended Internet Law, provides further guidance to the details of the social network providers’ obligations. Social network providers must assess the requirements and procedures within the New Principles and Procedures, while establishing mechanisms to comply with their new obligations under the Internet Law.