Turkey Officially Permits the International Transfer of Personal Data in Telecommunications Sector

In 2012 Turkey’s telecommunications sector regulator, the Information Technologies and Communication Authority (“ICTA”), issued a new regulation on the Processing of Personal Data and Protection of Privacy in the Electronic Communications Sector (“e-Privacy Regulation”) which introduced minimum security requirements and limitations for data retention and — most important of all — prohibited the international transfer of personal data. The e-Privacy Regulation was enacted by ICTA based on the authority to regulate the procedures and principles of data protection and data retention in the telecommunications sector, granted to it by Article 51 of the Electronic Communications Act (“ECA”).

After a series of amendments and postponements, the e-Privacy Regulation became effective on July 24, 2013, but the effective date of Article 4 prohibiting the international transfer of personal data without any exceptions was postponed until January 1, 2014. Then, in April 2014, only three months after the e-Privacy Regulation became fully effective, the Turkish Constitutional Court ruled that Article 51 of the ECA was in violation of the Turkish Constitution and therefore was void. The ruling was based on the constitutional principal that fundamental rights and freedoms can only be limited with laws and not with other legal acts with lower status – i.e., that the framework of the procedures and legal principles must first be regulated by act of law. The absence of a framework law on the protection of personal data in Turkey was underlined by the Constitutional Court. The ruling became effective on January 26, 2015, as a result of which Article 51 of the ECA was automatically annulled; however, certain disagreements on the validity of the e-Privacy Regulation remained and, accordingly, the status of the law on the international transfer of personal data was unclear for some time.

The arguments have now been silenced by the Turkish National Assembly when an omnibus bill created a new Article 51 for the ECA on April 15, 2015. Under the new law, Article 51 has been amended in conformity with the Constitutional Court’s ruling and the most significant regulations of the e-Privacy Regulation were transferred to Article 51 itself. Unlike the blanket prohibition of the previous (annulled) regulation, the new Article 51 permits the international transfer of personal data, provided that the data subjects’ explicit consent is obtained.

Yasemin Yanar is an Associate at the Gunalcin law firm in Istanbul, a Turkish firm which has an exclusive relationship with Locke Lord. She can be reached at yasemin.yanar@gunalcin.av.tr