The new regulation regarding the protection of personal data in the telecommunication sector superseding the Regulation1 in force in Turkey since 2004; Regulation Considering the Process of Personal Data and Protection of Privacy in Electronic Communication Sector (hereafter the “New Regulation”)2 has just been published in the Official Gazette in Turkey3.
In general, both the current and the New Regulation regard the procedures and principles of processing and keeping personal data by operators within the telecommunication sector, as well as privacy of communication. The New Regulation regulates some points that the Regulation did not, and it has more detailed provisions. For instance the time period to keep personal data for operators is one of the issues introduced for the first time. Furthermore, after the New Regulation enters into force, operators must keep statistical records regarding personal data shared with competent authorities. Additionally, the New Regulation unlike the current one not only requires operators to take necessary technical and administrative measures for the security of their networks, services and personal data of their subscribers, but also explains what the necessary measures are in that regard. In the same vein, unlike the Regulation, the New Regulation regulates in detail that under which circumstances data regarding communication traffic shall be processed. Moreover, the New Regulation clearly states that both data regarding communication traffic and geo-data shall not be taken to outside of Turkey. Transfer of data outside of Turkey has been under debate however, since there has been no explicit rule in this respect so far; however now we may say that this new data transfer restriction introduced under the New egulation provides clarity in this respect.
Considering the EU Data Protection Directive4 it should be noted that the New Regulation is in accordance with the data protection provisions of it. However the area of application of New Regulation is not as widely defined as the relevant EU directive. Thus there is still a lot to be implemented to achieve a comprehensive and widely applicable Turkish data protection regime even the New regulation might be considered as great achievement in that
To sum up, it is clear that the New Regulation lays more burdens on operators. However beside that direct outcome of the New Regulation, we are of the opinion that it is possible to define it as a reflection of developing Turkish telecommunication sector and legislation with that respect since developing practice guides the relevant authority(-ies) in terms of how the sector shall be regulated.
N. Cansın Karga
1 Regulation Considering the Process of Personal Data and Protection of Privacy inTelecommunication Sector (published in Official Gazette dated February 6, 2004, numbered 25365)(hereafter the “Regulation”).
2 It will enter into force on January 24, 2013.
3 Published in the Official Gazette dated July 24, 2012, numbered 28363.