The Information and Communication Technologies Authority ("ICTA") published the Draft Regulation on Processing and Protection of the Privacy of Personal Data in the Electronic Communications Sector ("Draft Regulation") for public notice and comment on their website on August 17, 2017. However, the current Regulation on Processing and Protection of Personal Data in the Electronic Communications Sector ("Effective Regulation") is still in force.

The Draft Regulation is based on Articles 4, 6, 12 and 51 of the Law No. 5809 on Electronic Communications ("Law No. 5809"), just like the Effective Regulation. Article 51 of the Law No. 5809 is the main provision concerning the processing and protection of the privacy of personal data in the electronic communications sector. Article 51 was previously annulled by the Turkish Constitutional Court's decision of April 9, 2014 with case number 2013/122 E and 2014/74 K. Subsequently, a new provision replacing the annulled provision was introduced and entered into legal force as of January 26, 2015.

Meanwhile, Turkey enacted a comprehensive law on the protection of personal data (Law No. 6698 on the Protection of Personal Data, or "Law No. 6698") on April 7, 2016.

The Draft Regulation, which was drafted after the enactment of the Law No. 6698, sets out the principles and procedures regarding the processing and protection of the privacy of personal data in the electronic communications sector, and incorporates the provisions of the Law No. 6698 that were not included in the Effective Regulation.

The Draft Regulation does not bring fundamental changes to the Effective Regulation, and mainly updates it in accordance with the new provisions introduced in the Law No. 6698.

The major changes proposed by the Draft Regulation are as follows:

  1. The storage of personal data relating to the content of communications was not included in Article 1(2) of the Effective Regulation. The Draft Regulation adds in and includes the storage of personal data in the relevant article. Therefore, the storage of personal data relating to the content of communications will also be subject to the Draft Regulation.
  2. Article 2 of the Effective Regulation is revised by the Draft Regulations so that it incorporates the Law No. 6698 as one of the legal grounds of the Draft Regulation.
  3. The definitions provided under Article 3 of the Current Regulation are expanded and the definitions relating to certain terms such as the "processing of personal data" and "explicit consent," which are also referred to by the Law No. 6698, are included in the Draft Regulation. The general principles relating to the processing of personal data under Article 4 of the Effective Regulation are modified and brought in line with the provisions of the Law No. 6698.
  4. The Draft Regulation also expands the scope of the Effective Regulation through the inclusion and incorporation of the rights of those parties (i.e., subscribers) whose personal data are being processed (Article 18). This provision is consistent with the Law No. 6698.
  5. The Draft Regulation also expands Article 5 of the Effective Regulation (entitled "Security") by including a provision that requires the operators to publish a privacy policy on their websites. It also incorporates the obligation to inform the data subjects of the processing of their personal data. According to this new paragraph, the operators must make the necessary notifications to the data subjects regarding the type of personal data being processed and the methods and means used for processing such personal data in line with the principles of transparency and accountability.
  6. A provision relating to the transfer of personal data abroad (Article 10) is also set out in the Draft Regulation. According to this new provision, the traffic and location information attached to such personal data cannot be transferred abroad without first obtaining the explicit consent of the data subjects. Such personal data can only be transferred abroad after notifying the data subjects about the scope of the personal data being transferred, the purpose and the period of the transfer abroad, and only after this transfer is examined and approved by the ICTA in terms of maintaining national security and public order.

The Draft Regulation was available for public consultation and comment for 30 days, until September 15, 2017, and may enter into legal force after the ICTA reviews and evaluates the public comments, and incorporates them into the Current Regulation, if and where it deems necessary.

This article was first published in Legal Insights Quarterly by ELIG, Attorneys-at-Law in December 2017. A link to the full Legal Insight Quarterly may be found here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.