Number: 22

Date: 01/08/2017

Title:

Draft Regulation on Processing of Personal Data in Electronic Communication Sector and Preserving Privacy published.


As per the concerning terms of the Law Regarding the Protection of Personal Data ("KVKK") no.6698 enacted as of 7 April 2016 and Electronic Communication Law no.5809, through the Information Technologies and Communication Board ("BTK" or "Board") Decision no. 2017/1K-THD/239 dated 07.08.2017, the Draft Regulation on Protection of Personal Data Processing and Privacy in the Electronic Communications Sector (“Draft Regulation”) has been published on the Board’s official web site, particularly for the purpose of gathering opinions from sectoral companies.

The Board assigned a 30 day period for the public examining of the 25 item Draft Regulation.

Terms of the Draft Regulation will be executed by the Board’s chairman.

The most remarkable content within the Draft Regulation are provided below;

- The subscriber is defined as “a real or legal person who is a party to a contract made with an operator for providing electronic communication service” in the Draft Regulation.

- The operators defined as the company providing electronic communication service and/or electronic communication network and operating the infrastructure are proposed to be setting the safety policies and taking the required administrative measures with a liability of clarification prior to the explicit consent.  

- Pursuant to the concerning Draft Regulation, it has become mandatory for operators to publish a privacy policy through the website.

- Pertaining to the Article 6, within the scope of the confidentiality and security of personal data, if there is a risk that violates the security of the network and personal data, the operator is liable for informing the BTK, Personal Data Protection Institute, subscribers/users and other related parties immediately.  

- It is indicated in the Draft Regulation through Article 8 that data traffic may only be processed for a certain purpose, however anonymous data should be used for marketing purposes or obtaining explicit consent to clarifies first.

- Provided that the period of limitation proposed in the concerning laws are preserved, data categories contained in Article 11 of the Draft Regulation, for the operational entries regarding system access, a 2 year retention period is required.

- Article 18 within the Draft Regulation arranges subscriber’s rights. By this way, clarification on CRM and reporting activities is provided.

- Besides other administrative sanctions, it’s indicated in Article 19 that terms of the Information Technologies and Communication Institution Administrative Sanctions Regulation will be applicable as well.

The concerning Regulation will be effective from publication date.


Our explanations provided above include general information on the issue. No responsibility can be claimed against EY and/or Kuzey YMM ve Bağımsız Denetim A.Ş. due to the implications arising from the context of this document or emerging with respect to its context.
 Print

Go to Top