Amendments to Law Numbered 6698 on the Protection of Personal Data

Key Changes Introduced by the Amendments

The amendments made to Articles 6, 9 and 18 of the KVKK bring important innovations, especially in terms of data transfer abroad and the conditions for the processing of special categories of personal data. This amendment, forming part of the long-awaited reform of the KVKK, is considered a significant step toward aligning Turkey's personal data protection legislation with the General Data Protection Regulation (GDPR) implemented in the European Union.

Newly introduced data processing conditions for the processing of special categories of personal data The amendments have abolished the distinction between data relating to health and sexual life and other special categories of personal data. Additionally, the grounds of lawfulness foreseen for processing conditions have been expanded.

Accordingly, processing of special categories of personal data is possible when:

• There is explicit consent of the person concerned.
• It is explicitly stipulated in the law.
• It is mandatory for the protection of the life or physical integrity of the person (or another person) who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid.
• It is related to the personal data made public by the data subject and in accordance with the will of the data subject to make it public,
• It is mandatory for the establishment, exercise or protection of a right.
• It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, as well as planning, management and financing of health services by persons under the obligation to keep information in secrecy or by authorized institutions and organizations.
• Mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance.
• It is aimed at current or former members and members of foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes, or persons who are in regular contact with these organizations and formations, provided that they comply with the legislation to which they are subject and their purposes, are limited to their fields of activity and are not disclosed to third parties..

Processing of health data in the employee-employer relationship
It is essential to evaluate how the newly introduced data processing conditions will address the challenges encountered while Article 6 of the KVKK was in force, particularly concerning the processing of health data solely by the employer, either based on explicit consent or through the workplace physician.

• The new data processing conditions to be considered in employment relationships are as follows:
  • Data processing is mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance.
  • Explicit stipulations in the law mandate such processing.
• What needs to be done: Data controllers should identify their legal obligations in the areas of occupational health and safety, social security, social services and social assistance, as well as the purposes of data processing explicitly stipulated by law. Additionally, a review of previously conducted health data processing procedures based on explicit consent is necessary. Failure to do so may lead to scrutiny by the Personal Data Protection Board (“Board”), potentially resulting in the determination that "seeking explicit consent in the presence of other personal data processing conditions could mislead the data subject and, consequently, be deemed an abuse of right by the data controller."

New Era in the Transfer of Personal Data Abroad

The approach that prioritizes explicit consent in the transfer of personal data abroad has been abandoned, and with the amendment, the requirements indicated below are sought for transfers to be carried out by both data controllers and data processors in the transfer of personal data abroad. Therefore, new transfer mechanisms will also need to be evaluated in this context.

Newly introduced data transfer methods abroad:

1. The Board's adequacy decision on the country to which the transfer will be made.
2. In the absence of an adequacy decision, but provided that the person concerned is also able to exercise his or her rights and have effective remedies in the country of transfer, one of the following conditions:
   1. The existence of an agreement, that is not qualified as an international agreement, between public institutions and organizations abroad or international organizations, and public institutions and organizations or professional organizations with public entity status in Turkey, and the permission granted by the Board for such transfer.
   2. The existence of binding corporate rules approved by the Board,
   3. The existence of a standard contract declared by the Board and notification made to the Personal Data Protection Authority ("Authority") within 5 (five) business days regarding the conclusion of the standard contract (administrative fines from 50,000 Turkish Lira to 1,000,000 Turkish Lira may be imposed for failure to make a notification), or
   4. The existence of a written undertaking containing provisions ensuring adequate protection and the permission granted by the Board for such transfer.

Some exceptions are provided for one-off, incidental data transfers. However, it should be noted that these exceptions shall not apply to continuous data transfers.

Another important point is that the data transfer rules will also apply to onward transfers.

It is indicated that the procedures and principles regarding the data transfer abroad will be further regulated separately by a regulation to be issued.

• What needs to be done: It is important to note that the amendments to the KVKK will come into effect on June 1, 2024. Until September 1, 2024, data transfer activities abroad based on explicit consent will need to be revised to align with the new regulations. During this transition period, data controllers may continue to transfer data abroad based on explicit consent.

In this context, before September 1, 2024, the following steps should be taken:

• Identify the transfers abroad.
• Control if there is an adequacy decision for the country and/or sector to which the transfer is intended.
• Determine the purposes of transfer and the nature of the recipient as data controller/data processor.
• Consider negotiating the signing of a standard contract, binding corporate rules, or a letter of undertaking with the other party. In this regard:
  • If a standard contract is executed, notification to the Authority must be provided within five business days.
  • Implementing Board-approved binding corporate rules may be advisable for groups of undertakings engaged in joint economic activity.
  • Signing a letter of undertaking containing provisions to ensure adequate protection and submitting it to the Board for authorization could be a viable option.

Appeal Against Board Decisions

Prior to the amendments, appeals against administrative fines imposed by the Board could be filed with criminal courts of peace. With the amendments, it is now possible to file a lawsuit before the administrative courts against administrative fines imposed by the Board.

Final Remarks and Next Steps

The amendments aim to harmonize the rules governing cross-border data transfers with the GDPR, a long-awaited goal that has been highlighted in various government action plans and programs, including the Human Rights Action Plan, the Economic Reforms Action Plan and the 2024-2026 Medium Term Program. These amendments will pave the way for clarifying the gray areas surrounding cross-border data transfers in Turkey and increasing the ability to comply with personal data protection legislation.

The regulation to be issued in order to regulate the data transfer process abroad in detail and to clearly set out the procedures will also be enlightening for data controllers and data processors and will accelerate the compliance process. It is expected that the Board will announce standard contracts suitable for different types of transfers: from data controller to data controller, from data controller to data processor and from data processor to data processor.