Turkish data authority greenlights data transfers to foreign jurisdictions

Turkiye

On 9 February 2021, the Turkish Data Protection Authority (“DPA”) published a notice on its website stating that the request from TEB Arval Araç Filo Kiralama Anonim Şirketi for data transfers abroad has been approved.

Specifically, the company is permitted to use its model clauses as a basis for transferring data to foreign jurisdictions where there may not be adequate levels of protection.

As the DPA's first public approval, the decision is considered a pioneering one and an important precedent for data controllers in the transfer of personal data without explicit consent to third countries where there may be insufficient protection of personal data.

Background

Pursuant to Article 9 of the Data Protection Law No. 6698 (“Law”), personal data may not be transferred abroad without the explicit consent of the data subject.

Certain legal grounds defined in the Law, however, allow for the foreign transfer of personal data without explicit consent.

According to Article 9 (2) of the Law, data may be transferred abroad without explicit consent in the following cases where the general exceptions (i.e. legal grounds such as legitimate interest) to explicit consent under Article 5 (2) of the Law or the exceptions relating to sensitive personal data under Article 6 (3) of the Law apply:

  • There is adequate protection of personal data in the target jurisdiction; or
  • The Turkish data controller and the foreign data controller undertake to ensure adequate protection of personal data and the DPA permits the transfer if there is no adequate protection in the recipient country.

Regarding the first point above, the DPA has not yet published a list of safe jurisdictions.

As for the second point, on 16 May 2018 the DPA issued a guidance on required content in cross-border data transfer agreements and issued two sets of model contractual clauses for data transfers to foreign data controllers and to foreign data processors.

The 9 February decision, as approved by the DPA, also falls within this scope, since the applicant and the foreign-based recipients are required to ensure the protection of personal data transferred to them. The applicant will no longer be required to obtain consent for the transfer of personal data to foreign jurisdictions.

Conclusion

The DPA's decision to approve the request by TEB Arval Araç Filo Kiralama Anonim Şirketi to conduct cross-border data transfers without explicit consent is expected to lead to an increase in requests from data controllers to have their model clauses approved for cross-border data transfers.

For more information on how the DPA's decision on cross-border data transfers could affect your business, contact your regular CMS advisor or CMS local experts: Dr Döne Yalçın or Sinan Abra.