ITCA Published New Principles And Procedures For Social Network Providers - Advertising, Marketing & Branding

Recent Developments

On 1 April 2023, the Information Technologies and Communications Authority (ITCA) published decision no. 2023/DK-ID/119, dated 28 March 2023, regarding the new set of Principles and Procedures for Social Network Providers ("New Principles and Procedures") in the Official Gazette no. 32150. The New Principles and Procedures provide details and clarification on the amendments to the Law on the Regulation of Internet Publications and Prevention of Crimes Committed through these Publications No. 5651 ("Internet Law"), which was adopted on 13 October 2022. The New Principles and Procedures are available online here (in Turkish).

What's new?

The ITCA's New Principles and Procedures is an updated version of the ITCA's previous Principles and Procedures for Social Network Providers dated 2 October 2020. The New Principles and Procedures mainly reiterate the ITCA's position regarding the new amendments to the Internet Law in October 2022, but also provide further clarifications on some of the requirements therein.

1. Scope

The New Principles and Procedures clarify the scope of social network provider regulations. In this regard, the following providers will be out of scope:

Persons that publish content for the purpose of social interaction that is only in a limited space on the platform (i.e., limited social interaction functionality)
Platforms, such as personal websites, e-commerce platforms and news websites, that provide a social interaction functionality as a secondary or an ancillary service.

2. New Requirements

Requirements*	Penalty for non-compliance**
Representative: The New Principles and Procedures initially reiterate the representative requirements for social network providers (e.g., "1 million daily access" requirement for appointing a representative as real person/legal entity and "10 million daily access" requirement for establishing a branch in the form of an equity company). The representative of a social network provider with more than 10 million daily accesses has full technical, administrative, legal, and financial liability for social network provider's compliance. Incorporation requirements ITCA states that the entity that meets the following requirements is deemed as the representative: The name of the representative must bear the unique tradename of the social network provider and the province where the entity is incorporated (e.g., Istanbul). All of the entity's shares must be owned by the social network provider. The articles of association must state that the representative is incorporated within the organization of the social network provider and is affiliated to the social network provider. Principal capital must be at least TRY 100 million (approx. USD 5 million). The articles of association must state that the social network provider holds the representative fully authorized, and the representative has full technical, administrative, legal, and financial liability. Documentation attesting the above and the following documents must also be submitted to the ITCA: The representative's article of association Trade registry gazette and other incorporation-related documentation Signature circular or other documentation showing the authorization of responsible individuals of the representative entity (i.e., authorized signatories of the representative) Identity and contact information of the authorized signatory(ies). Additionally, if the representative is a real person where the social network provider's daily access from Türkiye does not exceed 10 million, documents showing that the representative is a Turkish citizen and resident in Türkiye must be submitted to the ITCA. Any changes to the above documentation or information must be notified to the ITCA immediately and no later than 72 hours. Duties of the representative The representative has the following duties: Taking the necessary actions to comply with the notifications, notices or requests from the ITCA, Access Providers' Union or administrative authorities Responding to individual applications Compliance with reporting obligations (i.e., semi-annual/transparency reports) Complying with the obligations of the social network provider, which arise from the content provider or hosting provider status of the social network provider Compliance with other obligations under the Internet Law Other requirements are as follows: Representative's notification address and email address (including registered email address) must be easily accessible on the social network provider's platform Any changes to the representative's contact information must be updated on the platform Having a registered email address (i.e., KEP address) was not a regulatory requirement for representatives previously. It appears that this was introduced to facilitate the delivery of notifications to the representative.	Failure to comply with representative requirement are as follows (sanctions are implemented on a stage-by-stage basis): ITCA issues warning Administrative fine of TRY 10,000,000 (approx. USD 520,000) for failure to comply within 30 days of the receipt of the ITCA's warning Administrative fine of TRY 30,000,000 (approx. USD 1,560,000) for failure to comply within 30 days of the implementation of the first set of fines Advertisement ban for failure to comply within 30 days of the implementation of the second set of fines Internet bandwidth reduction by 50% for failure to comply within three months of the issuance of advertisement ban Internet bandwidth reduction up to 90% for failure to comply within 30 days of the implementation of the initial bandwidth reduction (the judgeship cannot issue a bandwidth reduction order below 50%, but it can determine a percentage below 90% depending on the nature of the service) *If the social network provider fulfills the representative requirement, only one-quarter of the administrative fines will be collected.
Response to user requests: As per the Internet Law, social network providers are required to respond to the requests of users under Article 9 and 9/A of the Internet Law within 48 hours. The New Principles and Procedures indicate that the social network providers must facilitate the receipt of the individual applications. Accordingly, users should be able to send their requests in Turkish language, and social network providers must respond to such requests in Turkish.	Administrative fine of TRY 5,000,000 (approx. USD 260,000) *Upon the complaint of a user to the ITCA, the ITCA evaluates whether the social network provider is complying with its requirements to respond to users. The ITCA evaluates the user complaints collectively during the semi-annual (transparency) report periods. In its evaluation, the ITCA takes into account whether the social network provider does the following: Established relevant systems to effectively respond to users Responds negatively to certain users or authorities on a regular basis, Complies with the timeframes envisaged in the Internet Law systematically Includes in its responses the rationale for objection/rejection of the application
Semi-annual (transparency) reports: The New Principles and Procedures set out that the reports must include the following additional information: Technical infrastructure, personnel and administrative capacity to ensure the enforcement of content takedown procedures and responding to individual applications Duration, geographical aspects and means of execution/implementation of decisions Categorical and statistical information on the process of handling individual applications, such as the number and type, positive and negative evaluation of applications, reasons for a negative response, response time Categorical and statistical information on the decisions of authorities, including the authority, means of receipt of the decisions, legal basis of the takedown order (e.g., Article 8 of the Internet Law), and timeframe for complying with the takedown order Categorical and statistical information on the self-assessment process Measures for equal and unbiased treatment of users Measures that allow users (i) to update their preferences regarding "recommended content" and (ii) to limit the use of personal data Information on the algorithms and transparency policies regarding hashtags, featured or restricted content Measures regarding the non-publication of content and hashtags relating to crimes under the Internet Law Advertisement policies Advertisement library The report to be prepared on the individual applications (i.e., Article 9 and 9/A requests) must also be published on the social network provider's website without revealing any personal data. In addition, the ITCA states that social network providers must comply with accountability principles and submit any necessary information and documentation as requested by the ITCA to ensure transparency.	Administrative fine of TRY 10,000,000 (approx. USD 520,000)
Advertisement library: In line with the amendments to the Internet Law, the social network providers are now required to prepare an advertisement library and provide information on this in the semi-annual reports. As per the New Principles and Procedures, the advertisement library must include the following: Details of the advertisement Type of the advertisement Ad provider The airtime of the advertisement The target audience of the advertisement and parameters used to define the target audience Number of individuals and groups reached with the advertisement The advertisement library must be easily accessible on the social network provider's website.	Administrative fine of TRY 10,000,000 (approx. USD 520,000) (in connection with the transparency report requirements)
Disclosure of user data to authorities: The New Principles and Procedures re-establish that the social network provider's representative must provide the information requested by public prosecutor's offices and courts during legal proceedings for the following offences: Sexual abuse of children (Article 103 of the Penal Code) Public dissemination of misleading information (Article 217/A of the Penal Code) Disruption of the unity and territorial integrity of the state (Article 302 of the Penal Code) Offences against the constitutional order and its functioning (Articles 309, 311, 312, 313, 314, 315, 316 of the Penal Code) Crimes against state secrets and espionage (Articles 328, 329, 330, 331, 333, 334, 335, 336, 337 of the Penal Code) The ITCA clarifies that the representative must directly respond to user data requests related to the above offences.	The public prosecutor's office or court may apply to the Ankara Judgeship of Peace to request an internet bandwidth reduction of up to 90%. The internet bandwidth reduction order is notified to the ITCA (who subsequently notifies the access providers). Access providers should execute the order promptly and no later than four hours. If social network providers comply with the user data/information request, the internet bandwidth reduction order is revoked.
Data localization: As per the Internet Law, social network providers must store Turkish users' data within Türkiye. The New Principles and Procedures clarify that the basic user information and information that may be required by the ITCA must be prioritized during the exercise of the data localization requirement.	Administrative fine up to 3% of the previous calendar year's global turnover
Services designed for children: In line with the amendments to the Internet Law, social network providers must take the necessary measures for providing services dedicated to/designed for children. The New Principles and Procedures clarifies that social network providers must take into account the following during the display of content, advertisements and provision of services to children: Age of the children Best interest of the children Protection of the physical, psychological and emotional development of the children Prevention of child abuse and commercial exploitation of the children Processing of minimum children data by applying high privacy settings Display of a user agreement, privacy policy and user settings in a manner that is understandable by children.	Administrative fine up to 3% of the previous calendar year's global turnover
Protection of user rights: The New Principles and Procedures provide further requirements regarding the protection of user rights: Social network providers must treat users equally and in an unbiased manner Social network providers must take measures to allow users to update their settings as to the recommended content and restriction on the use of personal data Social network providers must notify the users accessing the platform from Türkiye and the ITCA in cases of serious security breaches that directly or indirectly affect users from Türkiye within 72 hours Social network providers must make available in an easily accessible manner any update that affects the rights of the users Social network providers must provide information on the website as to which parameters the social network provider uses when recommending content to users in a clear, comprehensible and easily accessible manner Social network providers must provide understandable and easily accessible reporting channels (available in Turkish) for users to reach out in case of stolen and imposter accounts, and finalize the applications of users within due time. Social network providers must follow any additional guidance that may be given by the ITCA regarding user rights.	Administrative fine up to 3% of the previous calendar year's global turnover
Establishment of an application mechanism: As per the Internet Law, social network providers are obliged to establish an effective application mechanism in cooperation with the ITCA for the removal of hashtags and featured content through a warning method. The New Principles and Procedures state that the social network providers must inform the ITCA regarding this mechanism as part of semi-annual reports.	Liability for the content, in case of a failure to take down the content promptly and at the latest within four hours upon the notification of the illegal content
Content risking the life and safety of users: In line with the amendments to the Internet Law, if social network providers become aware of content that risks life and property of individuals that is also a case of urgency, it must notify authorized law enforcement authorities of the content and the content provider (i.e., user).	Administrative fine up to 3% of the previous calendar year's global turnover
ITCA's information request authority: In line with the Internet Law, the New Principles and Procedures regulate that the ITCA is authorized to request from a social network provider, all explanations relating to the social network provider's compliance with the Internet Law, including its corporate structure, information systems, algorithms, data processing mechanisms and commercial stance (tr. ticari tutum). Social network providers must provide the requested information and documentation within no later than three months.	Administrative fine up to 3% of the previous calendar year's global turnover
Crisis management plan: As per the Internet Law, the social network providers are required to prepare a crisis management plan. The New Principles and Procedures state that the ITCA may inform the social network providers regarding the aspects of preparation and disclosure of the crisis management plan.	Administrative fine up to 3% of the previous calendar year's global turnover
Content takedown: The New Principles and Procedures reiterates the measures in the case of non-compliance and states the following: The social network provider is responsible for the indemnification of damages due to non-compliance with a content takedown order/decision within 24 hours. This legal responsibility does not require filing of a separate lawsuit for this purpose. The social network provider is legally responsible for crimes committed through hashtags or featured content if it fails to takedown the content promptly and within no later than four hours from the official notification.	Failure to comply with the ITCA's content takedown orders (e.g., takedown orders on the basis of Articles 8 or 8/A of the Internet Law) will result in the following: 1. Punitive fine of up to TRY 5,000,000 (approx. USD 260,000) or an administrative fine of up to TRY 1,000,000 (approx. USD 50,000) 2. The ITCA can issue an advertisement ban for up to six months (the advertisement ban is not automatically lifted following compliance with the ITCA order) 3. The ITCA can request from the judgeship of peace to order an internet bandwidth reduction by 50% (irrespective of the advertisement ban) 4. Internet bandwidth reduction by 90% for failure to comply within 30 days of the initial internet bandwidth reduction decision

*The summary focuses on the new and/or clarified provisions in the New Principles and Procedures.
** The administrative fines are subject to increase based on the revaluation rate of the previous year.

3. Additional Provisions

Failure to comply with administrative fines: In cases where the social network provider fails to pay administrative fines more than once in a year, an advertisement ban for up to six months may be applicable.

On-site inspection: The ITCA is authorized to conduct on-site inspections of a social network provider's compliance with the Internet Law at all of the social network provider's facilities.

Requests related to number of daily access: A social network provider may request the ITCA to assess the situation where its daily access from Türkiye is consistently below 1 million or 10 million. The ITCA will notify the social network provider if the request is approved. However, if the ITCA determines that daily access from Türkiye exceeds the threshold again, it will notify the social network provider in this respect.

Entry in force: The New Principles and Procedures entered into force on the date of publication, 1 April 2023.

Conclusion

The New Principles and Procedures, in line with the amended Internet Law, provides further guidance to the details of the social network providers' obligations. Social network providers must assess the requirements and procedures within the New Principles and Procedures, while establishing mechanisms to comply with their new obligations under the Internet Law.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.