Turkey: Recently Proposed Amendments To Turkish Internet Law: Obligations Imposed On Social Network Providers

On April 9, 2020, online newspapers and other unofficial sources on the Internet spread the news that a Draft Law on the Amendment of Certain Laws ("Draft Amendment Law") had been prepared and sent to certain non-governmental organizations (NGOs) for their opinion and these sources published the proposed amendments. As per the preamble of the Draft Amendment Law, the main purpose is presented to be to prevent the potential negative consequences of the ongoing coronavirus (COVID-19) pandemic. An official text of the Draft Amendment Law is not yet publicly available. That said, the draft is in wide circulation through multiple NGO and stakeholder channels for meaningful participation concerning its contents.

The unofficial text of the Draft Amendment Law introduces certain important changes to the Law on the Regulation of Broadcasts via the Internet and the Prevention of Crimes Committed Through Such Broadcasts ("Law No. 5651"). Most significantly, the Draft Amendment Law introduces a brand new Internet actor, namely the "social network provider," into the realm of the Law No. 5651 and sets out significant obligations and procedures relating to this new specific actor.

I. "Social Network Providers": Definition and Scope

Article 53 of the Draft Amendment Law adds the new term "social network provider" under Article 2(1) Subsection (r) of the Law No. 5651. The term is defined as "[those] real or legal entities that enable users to create, share or view content, information or data such as text, images, sound, location on the Internet medium, for the purpose of social interaction."

According to the reasoning indicated under the preamble of the relevant provision, with this definition, the lawmakers aim to distinguish and include those social interaction channels that are popular with users and widely used for communication purposes. Based on the foregoing, social media networks, content-creating and -sharing platforms, and services enabling interactions between Internet users might be considered to fall within the scope of the definition. The definition of social network providers has been broadly drafted, and the scope will become clearer with the issuance of regulations on the implementation of these new provisions.

II. Obligations of Social Network Providers

Article 56 of the Draft Amendment Law sets out the obligations for Social Network Providers, which will be regulated under Additional Article 4 and its subparagraphs to be inserted into the Law No. 5651, as detailed below.

1. Obligation to Appoint a Representative

According to Additional Article 4(1), those foreign social network providers with more than one (1) million daily accesses from Turkey will be obliged to appoint at least one (1) representative in Turkey, who will be authorized to receive notifications, notices and requests from public authorities and/or private individuals, and to comply with and respond to such notifications, notices and requests. Moreover, said foreign social network providers will be required to notify the representative's identity and contact information to the Information and Communication Technologies Authority ("ICTA") and also display the representative's contact information on their websites in an easily accessible manner.

The criteria that will be considered for this representative to be appointed have not been clearly specified under the Draft Amendment Law. Therefore, the ICTA is expected to shed light into the procedure for the appointment of this representative by issuing a guidance on this matter soon after the Draft Amendment Law comes into effect, as per the Additional Article 4(9). Given the current wording of the of the article, which indicates that the social network provider should appoint a representative "authorized" to meet the requirements of the notices and requests from the ICTA and authorities and to respond to the individual requests; the ICTA might be seeking for more than a contact, but an actual real person representative of the social network provider that has the authority to decide on the outcome of the requests, to fulfill the incoming requests from the ICTA, the relevant authorities and the individual requests from users, and who could be held liable under Turkish laws, both under civil and criminal terms.

In cases of non-compliance, according to Additional Article 4(2), the ICTA will send a notice to those who fail to comply with the obligation to appoint a representative and duly notify the ICTA. If they fail to fulfill the obligation within thirty (30) days as of the receipt of the notice, the ICTA may apply to a criminal justice of peace in order to reduce the social network provider's Internet traffic bandwidth by 50% and thus implement throttling measures.

If the social network providers still fail to fulfill their obligations with respect to appointing and notifying a representative within thirty (30) days as of the execution of the throttling decision, the ICTA might then apply to the criminal justice of peace to request the Internet traffic bandwidth of such social network providers to be narrowed down by 95%. These decisions would be executed by the access providers immediately and within four (4) hours at the latest.

The decisions would automatically become void once the relevant social network operator complies with the obligation to appoint a representative and notify the ICTA.

According to the reasoning indicated in the preamble for Article 56 of the Draft Amendment Law, the provisions regulating the "representative" were introduced to address the difficulties that the public authorities face in practice, with respect to identifying an authorized addressee regarding the removal or access ban of illegal content broadcast on social media platforms. Furthermore, the preamble indicates that there are certain challenges regarding the service of official notifications or requests of Turkish institutions and organizations to various Internet actors (such as hosting providers, content providers, or access providers) located abroad.

2. Obligation to Respond to Individual Requests within 72 Hours

Those social network providers who fail to respond to such requests within seventy-two (72) hours will be subject to an administrative fine ranging from 100,000 to 1,000,000 Turkish Liras (approximately from USD 15.000 to USD 150.000 and EUR 14.000 to EUR 140.000 based on the currency rates of April 13, 2020).

To elaborate on the current provisions under the Law No. 5651 with respect to content removal and access bans: Pursuant to Article 9, any real person or legal entity or authority or institution, who claims that his/her personal rights have been violated due to a content broadcast on the Internet may apply to the content provider, or, if the content provider may not be reached, to the hosting provider, and request the removal of said content by the notice method. Alternatively, the claimant may also apply directly to a criminal justice of peace and request an access ban to the content in question.

Under the relevant provision, the criminal justice of peace's decision on the access ban of such content would be sent to the access provider via the Access Providers Union ("APU"), and the access provider would implement the decision immediately, and within four hours at the latest (Article 9(8) of the Law No. 5651). Moreover, per Article 9(10) of the Law No. 5651, in case the person responsible fails to comply with the decision of the criminal justice of peace in a timely manner and in accordance with the requirements of the Law No. 5651, they shall be penalized with a judicial fine ranging from five hundred (500) days up to three thousand (3000) days.

Any person, who claims that his/her right to privacy has been violated due to a piece of content broadcast on the Internet medium, may apply directly to the ICTA and request them to undertake appropriate measures and enforce an access ban to the relevant content. The ICTA would then send this request to the APU for enforcement, and the access providers are required to enforce such requests immediately, and within four hours at the latest [Article 9(A)(1)]. The person(s) requesting an access ban on privacy grounds are also required to submit their request to the criminal justice of peace within 24 hours as of their request for an access ban from the ICTA. The judge will evaluate and determine whether the broadcast on the Internet is indeed violating the applicant's right to privacy and announce his/her decision within forty-eight (48) hours at the latest, as well as sending it directly to the ICTA; otherwise, the access ban is deemed to be automatically void [Article 9(A)(5)].

In addition to the sanctions regulated under the relevant provisions, Article 5(6) of the Law No. 5651 states that hosting providers who do not fulfill their obligations set under this law shall be penalized with an administrative fine of 10,000-100,000 Turkish Liras by the ICTA.

In other words, the Draft Amendment Law imposes a new obligation on entities which are categorized as social network providers under the Law No. 5651 with respect to requests under Articles 9 and 9(A), in addition to their existing obligations under the current online content regulations as hosting or content providers.

3. Reporting Obligation

Additional Article 4(4), as introduced by Article 56 of the Draft Amendment Law, also requires that local and foreign social network providers with more than one (1) million daily accesses from Turkey shall provide the ICTA with reports that include statistical and categorical data regarding content removals, execution of access ban decisions and individual requests, in 3-month periods.

As for the content of such reports, since the wording of the relevant paragraph merely refers to the provision of statistical and categorical information, we believe that the data to be provided may consist of anonymized data, without reference to any personal information, although this is not explicitly stated in the relevant Article. As per Article 3 of the Data Protection Law ("Law No. 6698"), "anonymized data" refers to data that cannot be related to an identified or identifiable real person even through being linked to another piece of data.

Having said that, even if the reporting obligation would require the disclosure or transfer of any personal data to the ICTA, such disclosure/transfer might be deemed to fall within the scope of Articles 5(2)(a) and 5(2)(ç) of the Law No. 6698. These specific provisions stipulate that it is possible to process personal data without the explicit consent of the data subject where it has been explicitly anticipated under the laws and/or where said data processing is necessary for complying with a legal obligation that the data controller is subject to. In such cases, the data controller should still inform data subjects of (i) the identity of the data controller and of its representative, if any, (ii) the purposes of the processing, (iii) to whom and with what purpose the processed personal data can be transferred, (iv) the method and legal reason of the data collection, and (v) other rights of the data subject referred to in Article 11 of the Law No. 6698, in accordance with Article 10 of the Law No. 6698.

In light of the fact that the social network providers' main business would be closely related to user-generated online contents and information regarding the users, this reporting obligation might, at first glance, be deemed to potentially harm the confidentiality of information pertaining to the social network providers' business as well as their trade secrets. However, social network providers might refrain from disclosing certain data (to the extent that they indeed constitute trade secrets), as the reporting obligation only requires the disclosure of statistical and categorical data.

Social network providers who fail to comply with this reporting obligation shall be subject to an administrative fine ranging from 1,000,000 to 5,000,000 Turkish Liras.

4. Obligation to Host User Data in Turkey

Paragraph 5 of Additional Article 4, as introduced by Article 56 of the Draft Amendment Law, requires local and foreign social network providers with more than one (1) million daily accesses from Turkey, to host the data of Turkey-based users within Turkey. According to the preamble of the relevant provision, the aim of the data localization requirement is based on the purposes indicated under Article 22 of the Turkish Constitution, i.e., to ensure national security, public order, prevention of crime, protection of public health and morals, and the rights and freedoms of others.

Despite the data localization requirement, the Draft Amendment Law and the Law No. 5651 do not explain the criteria regarding how and when such data will be deemed to be hosted in Turkey. Generally, such data localization requirements prohibit certain data (including metadata and backups) from residing in or transiting into or out of certain areas or jurisdictions, or require that prior approval be obtained from a competent state authority for these purposes¹. Indeed, when the Turkish authorities' data localization approaches are considered (e.g., in the existing financial, telecommunications, insurance and data privacy legislations), hosting data in Turkey might entail either (i) hosting the relevant data in a physical server located in Turkey, or (ii) hosting the relevant data in a cloud-computing system that is based in a center located in Turkey.

With regard to the scope of this obligation, the Draft Amendment Law does not specify the particular data categories to be hosted in Turkey, and rather comprehensively targets all Turkey-based user data. Therefore, any data belonging to a user and/or identifies a user, including but not limited to identity, contact, account, or payment data for Turkey-based users might be deemed to fall within the scope of this data localization obligation.
When this data localization requirement is evaluated with the representative appointment requirement of social network providers, it is more likely for the authorities to prefer directly contacting local representatives of the social network provider instead of the principal (social network provider) and request data from them, as the assumption would be that the requested data should have been hosted in Turkey in any case (and the representative should have the authority to comply with such request).

If a social network provider fails to comply with this data localization obligation, such a provider could be subject to an administrative fine ranging from 1,000,000 to 5,000,000 Turkish Liras.

5. Obligation to Enforce Court Orders Within 24 Hours

In Paragraph 7 of Additional Article 4, it is also stipulated that social network providers will be liable for damages arising out of their failure to remove or block access within twenty-four (24) hours, to content that has been deemed unlawful by a judge or court order. Accordingly, social network providers will be required to remove or block access to unlawful content within twenty-four (24) hours of being notified of the relevant judgement or court order, or face claims of damages due to their failure to do so.

As explained above, those social network providers that also qualify as hosting providers under the Law No. 5651 already have existing responsibilities and obligations under Articles 9 and 9(A) regarding the removal of content, which also stipulate fines for failing to comply with these obligations.

Hosting providers have further obligations under Articles 8 and Article 8(A) of the Law No. 5651. Under Article 8, an access ban decision may be rendered if there is sufficient suspicion that the content in question constitutes or amounts to: (a) encouragement of suicide, (b) sexual harassment of children, (c) facilitation of drug use, (d) supply of substances which are dangerous to health, (e) obscenity, (f) prostitution, (g) provision of venue or opportunity for gambling, (f) defamation of the memory of Atatürk, founder of the Turkish Republic, or (g) crimes related to online betting, as per the Law No. 7258. Access blocking decisions should be granted on these grounds by the competent judicial authority, and such decisions should be immediately implemented by the access provider (i.e., within 4 hours at the latest, as of the notification of the decision).

Article 8(A) of the Law No. 5651 states that a decision for the removal of content and/or an access ban may be taken by the President (of the ICTA) in urgent cases, due to one or more of the following reasons: right to life, protection of life and property, protection of national security and the public order, prevention of crimes or protection of public health. Such decisions must be approved by the criminal justice of peace. Access providers, as well as relevant content and hosting providers, who fail to comply with the removal of content and/or access ban decisions granted within the scope of Article 8(A), shall face an administrative fine of TRY 50,000 up to TRY 500,000 by the ICTA.

Accordingly, social network providers might already have internal procedures in place to comply with access ban decisions under the Law No. 5651. However, the Draft Amendment Law imposes an additional liability on social network providers for the damages arising out of a failure to remove or ban access to content deemed unlawful by a judge or court order, within twenty-four (24) hours of notification.

III. Impact of the Draft Amendment Law on the Existing Obligations Under the Law No. 5651

The Law No. 5651 defines "content provider" as "the real persons or legal entities that create, alter and provide all kinds of information or data presented to users on the Internet" and "hosting provider" as "the real persons or legal entities that provide or run the systems that host the services and content."

As per Article 4 of the Law No. 5651, the content provider is responsible for any kind of content it makes available on the Internet. Generally, content providers should not be held responsible for content belonging to a third-party to which it links. However, the same article also states that, if it is clear from the content provider's way of presenting such third-party content (to which the link leads) that it adopts the third-party content and aims to provide users with access to that specific content, then it may be held liable pursuant to the general provisions.

Article 5 of the Law No. 5651 regulates the responsibilities of the hosting providers. Accordingly, hosting providers are not responsible for checking the hosted content or researching whether such content constitutes an unlawful activity. However, they are obliged to remove the illegal content, provided that they have been duly informed of it, pursuant to Articles 8 and 9 of the Law No. 5651.

Hosting providers are also obliged to retain the traffic information regarding their hosting services. Per the Regulation on the Procedures and Principles of Regulating Broadcasts via Internet, hosting providers should keep traffic information for six (6) months.

Pursuant to Law No. 5651, hosting providers must also maintain the accuracy, integrity and confidentiality of such information.

Additional Article 4(8) expressly states that the new provisions shall not remove the social network providers' obligations and responsibilities arising from their roles as content providers or hosting providers under the Law No. 5651. In other words, content and hosting providers will have to ensure that they continue to comply with their existing obligations under the Law No. 5651, while also fulfilling their new obligations as social network providers, if that is the case.

IV. Secondary Legislation on the Implementation of the New Provisions

As the new provisions added to the Law No. 5651 bring about significant practical changes, it will be necessary to regulate the procedures and principles for the implementation of these new obligations. According to the Draft Amendment Law, the procedures and principles regarding the implementation of the new provisions will be regulated by the ICTA.

In this respect, the ICTA might issue secondary legislation and/or guidance on these matters, such as the procedures for appointing a representative, the acceptable methods for individuals to send their requests to social network providers, and the statistical reporting obligations.

V. ICTA's Supervision/Audit Authority

Article 55 of the Draft Amendment Law, which inserts an additional subsection under Article 5(5) of the Law No. 5651, authorizes the ICTA to carry out audits directly or through third parties in order to assess whether or not hosting providers fulfill their obligations under the Law No. 5651. Under such audit authority, the ICTA might carry out on-site examinations and inspections and/or might assign third parties to conduct such examinations on its behalf.

The ICTA's relevant supervision and inspection authority applies to all hosting providers regardless of their status as social network providers. In other words, hosting providers that are not considered social network providers would also be subject to this authority, as well as social networks providers that are also deemed to be hosting providers.

This amendment might have implications for the representatives of the social network providers as well. Although the details of the representatives are yet to be determined, in cases where a social network provider is also considered to be a hosting provider, the ICTA might wish to conduct on-site examinations and inspections in the representative's facilities.

VI. Notification of Administrative Fine Decisions

The Draft Amendment Law sets forth a special notification procedure for instances where the addressee of the administrative fines is located abroad under Article 54, by inserting a new paragraph under Article 3 of the Law No. 5651. The purpose of this new procedure under Article 3(5) is stated as providing a solution to the difficulties that arise with respect to the service of notifications. With the amendment, the notification of administrative fines will be served on the addressee directly or via its representative in Turkey. The amendment indicates that notifications (regarding administrative monetary fines) can be made through e-mail or through other communication channels (as per paragraph 3 of Article 3), and that this will be deemed to have been made in accordance with the Notification Law No. 7201.

Per Article 3(3) of the Law No. 5651, notifications to entities carrying out activities in Turkey or abroad that fall within the context of this law may be served through e-mail messages or other communication means that are obtained or discovered based on information gathered from the sources, such as the communication tools on their webpages, their domain names, IP addresses, and similar sources.

The new amendment paves the way for Turkish authorities to formally serve administrative fine notices on Internet actors regulated under the Law No. 5651 (i.e., hosting providers, social network providers, etc.) by service of the relevant notice on their representatives in Turkey through e-mail communications or other channels.

V. Conclusion

The Draft Amendment Law and the changes it brings to the Law No. 5651 are creating new Internet actors from scratch. Therefore, these new amendments will highly concern the daily practices of a great number of local and foreign players who are active on the Internet. It is without doubt that these new amendments will be the main topic of discussion in terms of online content regulations in the near future.

With the anticipated economic package being featured in the Draft Amendment Law alongside the above-discussed changes to the Law No. 5651, Internet actors might expect the Turkish Parliament to rapidly discuss and review this matter. Therefore, the new statutory regulations might enter into force shortly.

In light of the foregoing, Internet actors might consider prioritizing the study of these amendments and rapidly undertake the necessary changes to their daily handlings of removal requests and user data to ensure compliance with the new obligations. In that respect, firstly, each Internet actor should determine whether their services would be considered to fall within the scope of the definition of social networks, and therefore, whether they would be deemed to be social network providers. Internet actors who are subject to these amendments would then have to assess and review their current processes, and engage in structural and risk-related analysis, as the amendments introduce multiple actions and measures to be taken, particularly on the part of social network providers.

Footnotes

1 Please see https://uncitral.un.org/node/2583/#localization (Last accessed April 12, 2020).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.