As part of the 8th Judicial Package, the Bill on Amendments to the Code of Criminal Procedure, Certain Laws and Statutory Decree No. 659 ("Bill") and its rationale have been submitted to the Presidency of the Grand National Assembly of Turkey. The Bill also includes provisions aiming to harmonize the Law on Protection of Personal Data (" LPPD") with the European Union's General Data Protection Regulation ("General Data Protection Regulation").
In this context, the major issues that fall within the scope of the Bill in terms of the LPPD are summarized below:
The "conditions for the processing of special categories of personal data" regulated in Article 6 of the LPPD have been expanded and various grounds for compliance with the law have been specified in addition to explicit consent. Thus, exceptions have been envisaged in accordance with the needs for fulfilling the obligations in the insurance sector, labor legislation, occupational health and safety and social services, and fulfilling the obligations of associations, foundations and similar organizations regarding their own activities.
A new system has been envisaged in terms of the "transfer of personal data abroad" regulated under Article 9 of the LPPD, and the existence of explicit consent has been made exceptional from being a general reason for data transfer. Accordingly, it has been made possible to transfer personal data abroad by making an adequacy decision about the country, international organization or sectors within the country to which the data will be transferred. In this way, the requirement to have an adequacy decision on the entire country has and the problems encountered in practice have been tried to be reduced by making an adequacy decision on a sectoral basis in the country where personal data will be transferred. In the absence of an adequacy decision, it will be possible to transfer personal data by providing "appropriate safeguards" under certain conditions. In the event that appropriate assurances cannot be provided, in exceptional cases and in the presence of the specified conditions, it will be possible to transfer data abroad a single or several times and in a non-continuous manner.
With the addition made to Article 9 of the LPPD, it is regulated that the relevant data controller or data processor must notify the Personal Data Protection Authority within five business days of the standard agreements regarding the transfer of personal data abroad. Furthermore, pursuant to Article 18 of the LPPD, administrative fines are provided for cases where this obligation is not fulfilled.
Administrative courts have been assigned as the sole judicial authority for the lawsuits to be filed against the administrative fines imposed by the Personal Data Protection Board. Thus, it is aimed to provide a more comprehensive review in administrative courts by closing the application to criminal courts of peace for administrative fines imposed under the LPPD. However, it has been stated that the files before the criminal courts of peace as of 01.06.2024 will continue to be examined and decided by these courts.
The Bill, which also contains detailed regulations on other issues, is expected to be discussed in the near future.