Turkish Personal Data Protection Board ("Board") has shed light on the legal situation of foreign companies and their liaison offices and branches in Turkey in terms of whether they are to be considered as data controllers under Turkish law and have an obligation to register to the Data Controllers' Registry ("VERBIS") in its decision dated 23/07/2019 and numbered 2019/225 which we will summarize below.

Board's Assessment on the Qualifications of the Data Controller and Foreign Legal Entities

Before delving into whether foreign legal entities and their liaison offices and branches in Turkey are to be considered as data controllers and their obligation to register to VERBIS, the Board first provided brief general information regarding how to determine a data controller under Turkish law. In this regard, the Board referred to the Article 3 of the Law No. 6698 on the Protection of Personal Data ("Law No. 6698"), where the data controller is determined as a natural or legal person who determines the purposes and means of the processing of personal data and is liable for the establishment and administration of the data filing system.

In addition to the criteria set out in the Law No. 6698, the Board suggested that the following should also be considered while determining a data controller:

  • Having the authority to decide on
    • the initial acquiring of personal data and the legal basis thereof
    • which personal data shall be processed for which purpose
    • methods of obtaining personal data
    • types of personal data to be processed
    • whose personal data will be processed
    • whether the access right and other rights of data subjects are exercised
    • whether personal data will be shared/transferred whom to share/transfer,
    • the retention period of personal data
  • Having separate legal obligations from the headquarters and having independent practices vis-à-vis data subjects.

The Board stated that establishing branches or liaison offices are some of the options that foreign legal entities have for operating in Turkey and that the determination of the scope of activities thereof is important while making an evaluation.

The Board ruled that the data controllers located abroad that process personal data in Turkey directly or through their branches are obliged to register to the VERBIS.

Board's Assessment on Branches of Foreign Legal Entities

The Board first referred to several relevant laws regarding the branches under Turkish law such as Turkish Commercial Code and Banking Law and stated that the criteria such as subordination under the headquarters, independency in activities vis-à-vis third parties and operating in a separate place and under a separate management should be considered while making a determination regarding the legal situation of the branches. In this regard, the Board stated that although the branches are not quite fitting the definition in the Article 3 of the Law No. 6698 since they are not vested with an independent legal personality apart from the main company under Turkish law.

However, the Board also referred to the Article 3 of the General Data Protection Regulation ("GDPR") on the territorial scope which stipulates that the GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not. The Board further stated that although the branches do not have a separate legal personality, they should be considered as data controllers provided that they act as a data controller independently from the foreign legal entity in terms of processing personal data in a way that falls within the scope of the abovementioned data controller criteria, considering that the branches are subject to registration to the trade registry likewise the local commercial enterprises as per the Article 40 of the Turkish Commercial Code numbered 6102 and that the Article 4 of the GDPR does not set out any criteria as "having a legal personality" for being considered as a data controller.

In this regard, just like other data controllers, they would be obliged to register to the VERBIS in case they exceed the limits specified in the Board's decision numbered 2018/88 such as employing over 50 people and having a balance sheet above TRY 25 million (approx. USD 4 million) annually.

Board's Assessment on the Liaison Offices

The Board stated that liaison offices are exempted from the obligation of registration to the VERBIS since (i) they can not engage in any commercial activities in Turkey, (ii) they only carry out limited activities such as communicating, researching, carrying out promotional and advertising activities and providing information to the headquarters and (iii) they do not have branch characteristics.

Conclusion

In light of the above, the Board reiterated that:

  • Data controllers located abroad that process personal data in Turkey directly or through their branches are obliged to register to the VERBIS.
  • Branches of the legal entities located abroad in Turkey are to be considered as separate data controllers from the legal entities provided that they determine the purposes and means of the processing of personal data and are responsible from creating and managing data registration systems and the fact that whether they are obliged to register to the VERBIS shall be determined after the evaluation to be made in terms of the "annual employee number" and "annual balance sheet total" criteria.
  • Liaison offices are not obliged to register to the VERBIS since (i) they can not engage in any commercial activities in Turkey, (ii) they only carry out limited activities such as communicating, researching, carrying out promotional and advertising activities and providing information to the headquarters and (iii) they do not have branch characteristics.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.