This Legal Alert aims at providing you with an overview on recent Decisions No. 2019/125 of Personal Data Protection Board (“Board”) on form of criteria for the determination of countries with adequate level of protection, which was published on the official website of the Data Protection Authority (www.kvkk.gov.tr).

Please note that this Legal Alert is intended to be general information purposes only. No statement herein contains any opinion or professional legal advice.

GENERAL OVERVIEW

Before elaborating on the criteria for the determination of countries with adequate level of protection, we would like to briefly touch upon the general provisions of transferring personal data abroad. As it is known, according to the Article 9 of the Law No. 6698 on the Protection of Personal Data (“Law”); personal data, cannot be transferred abroad without the explicit consent of the data subject. In the absence of explicit consent of the data subject, personal data can be transferred abroad, if:

(i) one of the following conditions is in place:

1. 1. • data processing is explicitly envisaged in the laws;
      • data processing is essential for protection of life or physical integrity of a person, who is not able to express his/her will due to practical impossibility, or of a person, whose will has no legal validity.
      • processing personal data of the parties to an agreement is necessary, provided that it has direct relevance to formation or performance of an agreement;
      • data processing is mandatory for data controller to fulfill its legal obligations;
      • data was made public by the data subject himself/herself;
      • data processing is essential for establishment, exercise or protection of a right; or
      • data processing is essential for the data controller’s legitimate interests provided that rights and freedoms of the data subject are not impaired.
      • For the special categories of personal data: Special categories of personal data except those relating to health and sexual life can be transferred without the explicit consent of the data subject, if permitted by the laws. On the other hand, personal data relating to health and sexual life can be transferred without the explicit consent of the data subject, only for the purposes of protection of public health; operation of preventive medicine, medical diagnosis, treatment and care services; planning and management of health services and its financing by persons under confidentiality obligation or authorized institutions and organizations.

AND

(ii) the relevant third country has an adequate level of protection (a list of which will be announced by the Board). In case there is not an adequate level of protection, the data controllers in Turkey and abroad should commit, in writing, to provide an adequate level of protection and the permission of the Data Protection Board must be secured.

In this context, in accordance with Article 9 of the Law, in its Decision No. 2019/125 the Board has announced the criteria to be taken into account in the determination of the countries with adequate level of protection.

THE CRITERIA FOR THE DETERMINATION OF COUNTRIES WITH ADEQUATE LEVEL OF PROTECTION

In the determination of the countries with adequate level of protection, the Board will take into account the criteria determined by its recent decision. Below are covered the main criteria announced by the Board. Please note that such main criteria are divided into sub-titles which are not listed herein.

• Reciprocity
• Legislation and application of the relevant country regarding the processing of personal data
• Existence of independent data protection authority
• Being a party to international treaties related to the protection of personal data and membership to international organizations
• Membership to the global and regional organizations to which Turkey is a member
• Volume of the trade with the relevant country
• Others