Technology law in Turkey: highlights from 2021 – Commentary

The Central Bank of the Republic of Turkey published the Regulation on Not Using Crypto Assets in Payments on 16 April 2021, and it entered into force on 30 April 2021. The regulation defines “crypto assets” and provides that cryptocurrencies cannot be used directly or indirectly in payments and that no service can be provided for the direct or indirect usage of crypto assets in payments.

The amendment entered into force on 1 May 2021, after being published in the Official Gazette No. 31471, and amended conditions of authorisation application, renewal periods, competency check and operator’s obligations. Additionally, new attachment documents (a draft notification form, a draft application form for right of usage, and a form providing the definition, scope and duration of services, networks and infrastructures of electronic communication) were presented.

The Turkish Ministry of Commerce published the guideline on 5 May 2021. The guideline determines the procedures and rules regarding commercial ads by social media influencers. Principally, social media ads must be clear, distinguishable and not covert. For this purpose, the guideline determines the use of tags for different types of social media platforms and obliges social media influencers and advertisers to comply with the legislation and to be fair, careful and responsible when advertising.

The regulation was published in the Official Gazette No. 31501 on 4 June 2021. It outlines banks’ obligations with regard to the protection of confidential information, including exceptions, the concept of a “client secret”, the principles of sharing secret information and the obligation to form an “Information Sharing Committee”. All of the definitions provided by the regulation refer directly to the Data Protection Law. On 24 December 2021, the effective date was changed from 1 January to 1 July 2022.

The Information Technologies and Communication Authority (ICTA) published the draft on 6 July 2021. This draft provides additional obligations for operators and new rights for natural persons or legal entities that are party to a contract entered into with an operator for the provision of electronic communication services. The process of receiving the opinions of the public regarding the draft has been completed, and the ICTA is working to finalise the draft regulation.

The Turkish Personal Data Protection Authority (DPA) made a public announcement regarding the ex officio investigation of an instant messaging app and published a decision on 3 September 2021, discussing data processing and data transfer operations. The DPA’s decision presented its approach to accepting subsequent processing operations on personal data collected from Turkey as an international transfer – if performed in servers located outside of Turkey.

The DPA published its recommendations regarding the protection of personal data in artificial intelligence systems on 15 September 2021. These recommendations consist of three parts:

• general recommendations;
• recommendations for developers, manufacturers and service providers; and
• recommendations for decision-makers operating in the field.

The DPA published the guideline on 17 September 2021. The guideline defines “biometric data” and divides it into two categories: physiological (eg, fingerprint and retina data) and behavioural (eg, the style of keyboard use). Additionally, to ensure that the guideline is useful, the DPA examined biometric data processing principles and biometric data security in detail.

Following a letter of the Ministry of Labour and Social Security dated 2 September 2021, which stated that employers can request polymerase chain reaction (PCR) tests once a week from non-vaccinated employees, the DPA published a public announcement on its official website on 28 September 2021. In the announcement, the DPA stated that, in order to prevent the spread of the disease, covid-19 vaccine information and/or negative PCR test information can be processed within the scope of the exception provisions of the Personal Data Protection Law No. 6698, which regulates the lawfulness of the preventive and protective activities carried out by public institutions and organisations.

The Digital Transformation Office published the Guideline on Information and Communication Security Audit on 27 October 2021. The new guideline regulates the audit processes which public institutions and enterprises that provide critical infrastructure services must carry out in order to ensure the security of critical data. The guideline regulates the planning, performing and reporting of those audits and obliges related institutions to establish an audit team.

The enforcement of the Regulation on Internet Domain Names, which regulates the sale and transfer of “.tr” domain names and was published in 2010, was postponed until the “.tr” Network Information System (TRABIS) became operational. On 19 November 2021, the platform Nic.tr announced that it expected the management of “.tr” domain names to be completely transferred to the ICTA by January 2022. However, as of February 2022, TRABIS is still not operational.

The DPA has introduced the concept of data protection officers with its communiqué published in the Official Gazette on 6 December 2021. Within the communiqué, a “data protection officer” is defined as a “natural person who is entitled to use the title of data protection officer by successfully passing the exam” and the training, examination and certification processes by which data protection officers are regulated.

Following the communiqué, the DPA announced on 10 December 2021 that data protection officers introduced via the communiqué are different from the concept of “data protection officer” under the EU General Data Protection Regulation.

Further, the Union of Turkish Bar Associations announced that it recently filed an annulment suit against the DPA in the Council of State. The Union claimed that the communiqué is contrary to the Attorneys’ Act No. 1136 because data protection officers must be lawyers, as the field of data protection is a legal discipline. Nevertheless, there has been no further development on this subject.

The Banking Regulatory and Supervision Agency published the regulation on 29 December 2021, and it entered into force on 1 January 2022. The regulation outlines obligations for banks that only operate through digital channels without any branch.