October 2022 – In September 2022, the Turkish Personal Data Protection Authority (“DPA”) held several seminars and announced six data breach notifications, but released no decisions.
On 10 September, at an event organised by the Istanbul Bar Association Personal Data Protection Commission and Bahçeşehir University Faculty of Law, the President of the DPA stated that the DPA is preparing good practice guidelines for the protection of personal data in various sectors, including tourism, aviation, telecommunications and advertising.
DP law amendment coming soon!
A year ago, the Ministry of Justice established a Scientific Commission to amend Turkish Data Protection Law numbered 6698 in order to harmonise the local legal system with the EU's GDPR.
In September, the Scientific Committee's academic members announced that provisions on data transfers abroad and the processing of special categories of personal data have been prioritised. Parliament is expected to discuss these provisions during its next legislative session, which starts in October.
Seminars on machine learning and big data
On 21 September, the DPA held a seminar on the opportunities and risks of big data applications. The following issues were highlighted:
- matching of user profiles between social networks;
- using data in algorithms to create popularity and ranking characteristics relating to content on social platforms;
- making data-driven decisions through data analysis;
- risks of data storage units (i.e., cloud systems).
Earlier in the month, on 7 September, the DPA held a seminar on the processing of personal data in the context of machine learning. The following issues were highlighted:
- problems that machine learning may cause in terms of personal data;
- the need of cloud systems to store large amounts of data;
- cross-border data transferring issues in connection with cloud systems;
- data minimisation and personal data protection problems due to the large amount of data processing in machine learning processes;
- difficulties in fulfilling the obligation to inform and obtain explicit consent.
The DPA announced the following data breach notifications in September:
|
Data Controller |
Affected Data Subjects |
Affected Personal Data |
Number of Data Subjects |
|
Flo Mağazacılık ve Pazarlama A.Ş. |
Website users |
Identity, Financial and Transaction Security Data |
3,500 |
|
Özel Keystone Eğitim ve Eğitim Dan. A.Ş. |
Employees, Users, Subscribers / Members, Students, Customers and Potential Customers |
Identity, Communication, Financial Data, Personnel Information, Information on Legal Processes, Risk Management and Other |
N/A |
|
Marmara University |
Employees and Users |
Identity, Communication Data and Personnel Information |
5,698 |
|
Fuudy Elektronik İletişim Perakende Gıda Lojistik Anonim Şirketi |
N/A |
Identity and Communication Data |
81,452 |
|
Biblos Alaçatı Turizm Yatırımları A.Ş. |
Employees, Customers and Potential Customers |
Identity, Communication, Customer Transaction, Financial and Marketing Data, Audio and Visual Records, Health and Biometric Data |
450 |
|
Posta ve Telgraf Teşkilatı Biriktirme ve Yardım Sandığı |
Members |
Identity and Transaction Security Data |
38,000 |
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.