In October, the significant developments in the field of personal data protection are the cooperation protocol executed between the Personal Data Protection Authority ("Authority") and the Radio and Television Supreme Council ("RTUK") and the seminar held by the Authority on cookies.
We set out summaries of developments in October in Turkey and from the world below:
Announcement – A cooperation protocol was signed between the Authority and RTUK
The Authority published a public announcement regarding the cooperation protocol signed with RTUK on 26 October 2021.
The Authority underlined that disrespect to the right to privacy and easy disclosure of personal data, especially in generational programs, constitute a violation as per the Law on the Protection of Personal Data No. 6698 ("Law") and the Law on the Establishment and Broadcasting Services of Radio and Televisions No. 6112.
Within the scope of the protocol, coordination units within both institutions will be established in order to carry out joint seminars, trainings, workshops and similar activities. The protocol is agreed to remain in force for a period of two years and be automatically renewed for one year provided that none of the parties issue a notice of termination 30 days before the end of this period.
The announcement is available online here (in Turkish).
Announcement – The Authority will host the 44th Global Privacy Assembly (GPA) Conference in 2022
As a principal member of the GPA, which aims to increase cooperation and exchange of information between data protection authorities, the Authority announced that the 44th GPA Conference will be held in Turkey next year.
The announcement is available online here (in Turkish).
Seminar – Recent developments on cookies and explicit consent
In the seminar organized by the Authority on 6 October 2021, various cookie usage techniques and methods for obtaining explicit consent were examined. In this context, having evaluated explicit consent under three main crieria, namely (i) free will, (ii) active action and (iii) informing, it was underlined that these criteria can be vulnerable against infringements via technical methods and website designs.
In terms of cookie practices, the "opt-in" method, which refers to the activation of the initially passive cookie settings, was pointed out to be more in line with the European Union legislation. Additionally, concealing the consent for commercial electronic messages under links such as "click for more information" and obtaining consent from users by using complicated expressions are considered as phishing and deemed against the obligation to inform data subjects.
The companies whose servers are located abroad, and that procure web design services from third parties, may lack sufficient information as to use of cookies and may tend to address their cookie-related questions to service providers. Since these service providers providing web design services to data controllers are likely to be held responsible with respect to data protection requirements, the Authority advised such data controllers to revisit their service agreements to reflect necessary terms as to data protection.
Lastly, the Authority pointed out the importance of awareness by web design and data analysis companies as to the usage of cookies, and invited these companies to adopt the "privacy by design" principle.
Significant developments from the world
EU and Japan conducted the first review of the mutual adequacy agreement
On 26 October 2021, the European Commission and Japan released a joint statement on the first review of the EU-Japan mutual adequacy arrangement effective since 2019. According to the statement made by Didier Reynders, European commissioner for justice, the adequacy decision created the world's largest area of safe data-flows while leading to an increased convergence between the data protection systems of both sides. Shuhei Ohshima, commissioner at the Personal Information Protection Commission, remarked that remaining procedural steps can be completed by the end of this year.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.