Edition 63: 22 March 2018
Editorial Team:
Orçun Çetinkaya, LL.M., Ezgi Baklacı, LL.M., and Pelin Oğuzer, LL.M.
Turkey’s Data Protection Board Announces Rules for Processing Special Categories of Personal Data

Turkey’s Personal Data Protection Board (“Board”) has announced rules for processing special categories of personal data. Notably, data controllers must prepare a separate policy and procedure for protecting special categories of personal data. The Board also emphasized the importance of the measures which had previously been determined in the Personal Data Security Guide.

Turkish legislation deems the following personal data to fall into a special category, subject to increased rules and requirements: race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, biometric and genetic data. Legislation states that persons processing special categories of personal data must take adequate measures, as announced by the Board (Article 6/4 of Personal Data Protection Law number 6698).

Accordingly, the Board announced that data controllers processing special categories of personal data must:

– Prepare a separate policy and procedure for processing special categories of personal data.

– Take certain measures for employees involved in processing such data, such as:

– Organize the required trainings.

– Arrange and sign confidentiality agreements.

– Determine access rights and regularly make authority checks.

– Immediately remove authority from employees which change duties or leave the company.

– Retrieve any data inventory assigned to the employee.

– Take certain measures when processing such data in an electronic environment, such as:

– Keep the data by using cryptographic methods and keep cryptographic authentication keys in secure and different environments.

– Keep data processing logs in a secure manner.

– Constantly undertake security updates for the data processing environments.

– If data is accessed through software, take certain specified measures regarding use of the software.

– Use at least a two-step verification for remote access to data.

– Take certain measures while processing such data in a physical environment, such as:

– Take adequate security measures depending on the nature of the physical environment (electrical leakage, fire, flood, burglary, etc.)

– Secure the physical environment and prevent any unauthorized entry.

– Take certain measures for transferring of such data, such as:

– Use corporate e-mail and registered e-mail systems as well as encryption for transfers via e-mail.

– Use cryptographic encryption and keep the cryptographic keys in different environments for transfers via USBs, CD or DVDs etc.

– Use VPN or sFTP methods for transfers between different servers in different physical environments.

– Take necessary measures to prevent risks such as loss or burglary and identify the document as “confidential”, if data is transferred on paper.

The Board’s Decision number 2018/10, dated 31 January 2018 was published in Official Gazette number 30353 on 7 March 2018. The full text can be found at this link (only available in Turkish).

Read More
Turkey Announces Rules and Processes for Data Subjects to Exercise their Rights, Plus Corresponding Requirements for Data Controllers

Turkey has announced rules and processes for data subjects to exercise their rights regarding personal data, as well as corresponding requirements for data controllers which process the information. Accordingly, data subjects can apply to data controllers via a range of methods, provided the application includes certain specified information. Minimum requirements have also been announced for data controllers’ response and related fees.

The Communiqué on Principles and Procedures for Application to Data Controller (“Communiqué“) was published in Official Gazette number 30356 on 10 March 2018, entering into effect on the same date.

Notable provisions in the Communiqué include:

– Data subjects can apply to the data controller via:

– Writing to the postal address of the data controller.

– Secure electronic signature to registered e-mail address of the data controller.

– Mobile signature.

– e-mail from e-mail addresses of the data subjects which are registered in the data controller’s system to the data controller’s e-mail address.

– Software or applications developed for this purpose.

– Detailed rules for the information which must be included in:

– The data subject’s application, such as:

– Name, surname and signature, if the application is made in writing.

– Turkish ID number (for Turkish citizens).

– Nationality, passport number or identity number, (for non-Turkish data subjects).

– Residential or work address for notification.

– E-mail address (if any), phone and fax number.

– Subject of the application.

– The data controller’s response, such as:

– The matters mentioned under the application.

– Information about the data controller or its representative.

– Explanations about the data controller related to the application.

– For written applications, the application date is the date which the related document was notified to the data controller or its representative.

– For applications made by other methods defined in the Communiqué, the application date is the date which the application reached the data controller.

– If the response exceeds ten pages, the data controller can charge 1 Turkish Lira per page.

– If the response is given through a data recorder (such as CD, flash memory) then the data controller can charge the cost of the data recorder as a maximum price.

Please see this link for full text of the Communiqué (only available in Turkish).

Read More
Turkey Announces Details for Information Disclosures Which Data Controllers Must Make While Collecting Personal Data

Turkey’s Personal Data Protection Board has announced further details about the content and method of disclosures and declarations which data controllers must make while collecting personal data. Such declarations can be made in a range of methods, provided they are in clear, plain and simple language. Notably, disclosures must be made every time personal data is processed, regardless of the data subject’s request and any legislative exceptions which may apply related to obtaining explicit consent.

Data controllers (or their authorized representatives) must make certain disclosures and declarations to data subjects when collecting personal data (Article 10 of Data Protection Law number 6698; “Law“). Declarations should include at least:

– The data controller’s identity, as well as its representative (if any).

– The purposes for processing personal data.

– The persons to whom processed personal data might be transferred and the purposes for this.

– The method and legal basis for collecting personal data.

– The data subject’s rights.

The Communiqué on Procedures and Principles regarding the Data Controller’s Obligation to Inform (“Communiqué”) was published in Official Gazette number 30356 on 10 March 2018, entering into effect on the same date.

The Communiqué outlines further details about the declarations which must be made under Article 10 of the Law:

– Declarations can be made by using physical or electronic mediums, including oral and written methods, voice recordings, as well as call centers.

– Declarations must be made every time personal data is processed. The obligation does not depend on the data subject’s request and applies regardless of whether any exceptions to explicit consent apply under the Law.

– If the purpose for processing personal data changes, the data subject must be informed about the new purpose before the data is processed.

– Data collectors bear the burden of proving they have met obligations to inform data subjects.

– If different parts of the data collector’s business process personal data for different purposes, the data subject should be informed separately for each business unit.

– If personal data is processed based on explicit consent from the data subject, the declaration and obtaining explicit consent must be performed separately.

– If a party is required to register with the Data Controller’s Registry, the information stated during the declaration must comply with the information disclosed to the Data Controller’s Registry.

– The purpose for processing personal data stated in the declaration must be specific, clear and legitimate. Statements shouldn’t be ambiguous or general. Expressions which create the perception that personal data could be processed for other purposes which arise should not be used.

– The declaration should be made in a clear, plain and simple language.

– The declaration should specify which processing basis under Article 5 and 6 of the Law applies.

– The persons to which receiver groups the processed personal data might be transferred should be identified, along with the purposes for processing personal data.

– The declaration must clearly state which method is used when processing personal data. Methods can be partially or completely automatic/non-automatic, provided it is a part of the data recording system.

– Incomplete, misleading, or incorrect information should be avoided while making the declaration.

– If personal data is obtained from a party other than the data subject:

– The declaration must be made to the data subject within a reasonable period after obtaining the personal data.

– If the personal data will be used to communicate with the data subject, the declaration should be made during the initial communication.

– If personal data will be transferred, the declaration must be made to the data subject at the time of the first transfer of personal data, at the very latest.

Please see this link for full text of the Communiqué (only available in Turkish).

Read More
Turkish Capital Markets Board Exempts Publicly Held Companies from Requirement to Keep Domestically-Located Information Systems

In January 2018, Turkey’s Capital Markets Board (“Board”) introduced new rules requiring capital markets institutions and publicly held companies to locate their primary and secondary information systems within Turkey (more). However, the Board has now announced an exemption for publicly held companies.

Therefore, publicly held companies which are not subject to periodic information systems auditing are exempt from being required to locate their primary information systems within Turkey.

However, the Board also noted that information systems audit obligations will gradually expand over time, with publicly held companies facing audits at a later date. Therefore, publicly held companies will be required to have their primary information system located within Turkey at some point, so these companies should plan accordingly.

Please see this link for the full text of the Board’s decision number i-SPK.62.1 (only available in Turkish).

Read More
Turkey Updates Rules for Movable Pledges and Assignments

Turkey has updated rules related to pledges on movable assets. Notably, all future legal interests in a movable asset will now be directly covered by a pledge, together with the movable asset. If a production process is pledged together with a movable asset used in the process, the pledge will now be deemed to have been automatically established.

The Law Amending Certain Laws for Enhancing the Investment Environment number 7099 (“Omnibus Law”) was published in Official Gazette number 30356 on 10 March 2018.

The Omnibus Law makes changes to The Law on Pledge on Movables in Commercial Transactions number 6750.

Notable changes under the Omnibus Law include:

– All possible future legal interests in a movable asset (such as insurance, interest, or natural products and their substitutable goods) are now directly covered by the pledge, together with the movable asset.

– If a production process is pledged together with the movable assets used in the process, the pledge will now be deemed to have been automatically established, receiving the same ranking for receivables incurred in the production process. In this regard, the good faith of a bona fide third person who does not know (or does not need to know) that a movable is pledged is protected.

– Time periods have been introduced for applications to release a pledge. The pledgee must now apply to the Movable Pledge Registry to release of the pledge record:

For local creditors: Within 15 business days of the date the pledged receivable expires.

For foreign creditors: Within 30 business days of the date the pledged receivable expires.

– The administrative fine amounting to 10% of secured obligations for breaches of the obligation above now applies only upon complaint by the pledgor or debtor.

– If a party defaults on debts secured by a pledge, it has now been clarified that the creditor can refer to debt-collection under general legislation (for example, the Turkish Enforcement and Bankruptcy Law), as well as other enforcement methods under the Law.

– Provisions of the Turkish Civil Code number 4721 concerning immovable property will now apply if there is a gap in the Law for the related topic.

Please see this link for the full text of the Omnibus Law (only available in Turkish).

Read More
Turkey Streamlines Company Establishment Procedures

Turkey has amended various aspects of company establishment procedures, aiming to accelerate the process. Accordingly, some authorities and approvals which previously sat with public notaries have now been transferred to commercial registries. Public notary approval has also been revoked completely in some procedures.

The Law Amending Certain Laws for Enhancing the Investment Environment number 7099 (“Omnibus Law”) was published in Official Gazette number 30356 on 10 March 2018. The Omnibus Law makes changes to the:

– Tax Procedure Law number 213.

– Turkish Commercial Code number 6102.

– Social Security and General Health Insurance Law number 5510.

Key changes under the Omnibus Law include:

– Commercial books for joint stock companies, limited liability companies and cooperatives no longer need to be notarized during incorporation. Rather, these now only need to be approved by the commercial registry where the company or cooperative is based.

– When registering joint stock and limited liability companies to the commercial registry, approval for opening commercial books will now be obtained from commercial registries, rather than public notaries.

– Merchants can now submit their commercial title and signatures directly to commercial registries, without having them notarized. Signature declarations are submitted to the commercial registry in the same manner as submitting a written declaration.

– Company founders are no longer required to have their signatures notarized. Therefore, articles of association now only need to be signed at the commercial registry, before authorized personnel.

– Founders of limited liability companies are no longer required to bring 25% of the nominal guaranteed share value as cash before registration.

– The following types of shareholder representatives during joint stock company general assemblies have been revoked from Turkish Commercial Code:

– Representative bodies.

– Independent representatives.

– Corporate representatives.

– When a company incorporation is reported to a commercial registry, this report will now be deemed as if it was also submitted to the Social Security Agency (“Agency”). An additional workplace declaration for the Agency is no longer required.

– The Agency will now determine which notifications from the following entities it will deem as “workplace declarations” and no additional workplace declaration will be required:

– Office of the governor.

– Municipality.

– Other public or private entity bearing the authority to issue permits.

Please see this link for the full text of the Omnibus Law (only available in Turkish).

Read More
Turkey Updates Processes for Property Ownership and Easements

Turkey has updated several provisions relating to establishing flat ownership and easements, as well as land use conversion. Under the changes, land registrations will now be based on electronic architectural projects and residency usage permits. Further, contractors can establish such rights, provided certain conditions are met.

The Law Amending Certain Laws for Enhancing the Investment Environment number 7099 (“Omnibus Law”) was published in Official Gazette number 30356 on 10 March 2018. The Omnibus Law makes changes to the Law on Property Ownership.

Notable changes under the Omnibus Law include:

– Previously, only property owners could establish certain rights. Courts might order the establishment of such rights as well. However, contractors can now also establish the following, provided each owner’s independent section is determined:

– Flat ownership.

– Easements.

– Land use conversion transactions.

– Contractors can now register land by submitting any of the following agreements:

– Construction agreement in return for flat.

– Transfer agreement in return for flat.

– Notary agreements regarding partition of independent sections.

– For contractors to establish flat ownership, they must now submit electronic copies of the architectural project and management plan to deed offices, approved by the competent authority.

– Documents for land use conversion transactions can now be provided electronically to deed offices.

Please see this link for the full text of the Omnibus Law (only available in Turkish).

Read More
Turkey Announces Criteria for Payment Deferment Where Tax Debts Would Cause Serious Financial Difficulty

If a taxpayer will fall into serious financial difficulty by paying a tax debt, a mechanism exists in Turkey to defer payment for up to five years, under certain conditions (Article 48/A of the Law on the Collection of Public Receivables number 6183, dated 21 July 1953). The Council of Ministers has now announced calculation methods for determining whether an entity is at risk of suffering serious financial vulnerability, as well as revised deferment periods and interest rates. The revised mechanism applies to public debts which have become due since 1 January 2018.

Council of Ministers’ Decision number 2018/11284, dated 22 January 2018 (“Decision”), was published in Official Gazette number 30342 on 24 February 2018.

To benefit from the deferment procedure, taxpayers must be subject to corporate income tax or personal income tax due to their commercial, agricultural or professional activities.

The Decision introduces separate calculation methods for defining “serious financial difficulty” for:

  • Taxpayers which maintain commercial books based on balance sheet.
  • Other taxpayers.

Taxpayers which maintain commercial books based on balance sheet

For these taxpayers, the following financial indicators should be used when determining the entity’s financial situation.

Other taxpayers

For all other taxpayers, the following financial indicators should be used when determining the entity’s financial situation.

Thresholds and deferment periods

After making the calculations above, taxpayers will now be deemed to be at risk of serious financial difficulty if all of the following conditions are met:

– Cash-Flow Ratio is 10% or less.

– Liquid Ratio is 70% or less.

– Leverage Ratio is 70% or more.

The deferment period and rate applied to the debt will now vary depending on the degree of financial difficulty, as determined by the ratio calculation.

Please see this link for the full text (only available in Turkish).

Read More
Turkey Updates Rules for Title Deed Transactions

Turkey has revised rules for executing mortgage deeds, meaning that credit institutions and agricultural credit cooperatives can now conclude mortgage contracts without being required to execute the mortgage deed in person before the title deed registry. Furthermore, parties are no longer required to apply in person to register debt or credit contracts at the Land Registry.

The Law Amending Certain Laws for Enhancing the Investment Environment number 7099 (“Omnibus Law”) was published in Official Gazette number 30356 on 10 March 2018. The Omnibus Law makes changes to the:

– Article 26 of the Land Registry Law number 2644

– Article 9 of the Law on Organization and Duties of the General Directorate of Land Registry and Cadastre numbered 6083.

The scope of people who are not required to execute mortgage deeds in person before the title deed registry has been extended. Credit institutions and agricultural credit cooperatives can now conclude mortgage contracts via a written agreement, with the parties no longer being required to execute the mortgage deed before the title deed registry.

Therefore, mortgages provided as collateral for debts and loans established (or to be established) by the following entities can now be registered with the title deed, including reference to the loan or debt contracts:

– Credit institutions (new).

– Agricultural credit cooperatives (new).

– State institutions and organizations.

– Banks.

– Credit and surety cooperatives for tradesmen and craftsmen.

To accelerate registration of title deed transactions, transactions conducted at land registry offices will be electronically shared directly with judicial authorities, authorized institutions and organizations. Accordingly, the following transactions related to annotation and declaration (such as attachments and sales annotations) will now be done electronically:

– Registrations.

– Annulments.

– Amendments of transactions.

Please see this link for the full text of the Omnibus Law (only available in Turkish).

Read More
Turkey Launches Automotive Product and Vehicle Safety Scheme

Turkey has introduced a product safety scheme for new cars and automotive products. The Ministry of Science, Industry and Technology (“Ministry”) will now actively monitor the market and conduct inspections to ensure they meet technical regulations. The Ministry’s monitoring and inspection activities will apply to automotive products and vehicles which are supplied to the market, distributed, exported, imported, assembled, or put into service.

The Regulation on Market Supervision for Automotive Products (“Regulation”) was published in Official Gazette number 30340 on 22 February 2018, effective from 22 August 2018.

An automotive product or vehicle is deemed to be supplied to the market if:

– It is advertised for sale or lease (TV, radio, internet, printed media, or other communication tools),

– A certificate of compliance is prepared, or

– An invoice is prepared.

The Ministry will now undertake market supervision activities, including:

– Examine labels and documents outlined in the technical regulations.

– Examine information and/or documents regarding a product’s safety (according to Article 5 of the Regulation), if no technical regulation is available.

– Sensory examination.

– Test and inspection.

Non-compliant products fall into two categories:

– Products which do not meet technical regulations, but are not unsafe. For these, producers must provide a compliance plan and rectify the product’s failure within the given period.

– Unsafe products.

Administrative fines between 4,000 and 50,000 Turkish Lira will apply for failing to submit a compliance plan or remedy non-conformance.

The Ministry can now take the following measures, subject to the principle of proportionality:

– Ban products from being supplied to the market.

– Pull products from the market.

– Disable products.

– Recall products, if they cannot be made safe, or the producer fails to make them safe.

– Other measures, outlined in technical regulations.

– Ban products from being driven.

Producers can also voluntarily recall risky or non-conforming products from the market, without the Ministry’s intervention.

Please see this link for the full text of the Regulation (only available in Turkish).

Read More
Turkey’s Constitutional Court Dismissed an Application Seeking Cancellation of Provisions Regulating Payment of Electricity Loss and Leakage Fees by Consumers

Turkey’s Constitutional Court recently dismissed an application seeking to cancel 13 articles of the Law Amending the Electricity Market Law and Certain Other Laws numbered 6719, dated 4 June 2016 (“Amendment Law”).

130 deputies and several first instance courts applied to cancel the following key clauses in the Amendment Law, claiming they were unconstitutional for a range of reasons.

After consideration, the Constitutional Court ruled that the clauses were not unconstitutional. It noted that the administration is entitled to regulate issues which are not necessarily covered by laws, provided the regulation has legal grounds.

Provisions of the Amendment Law under dispute include:

– Provisions allowing collection of electricity loss and leakage fees from consumers, calculated as the difference between the amount of supplied energy and energy charged to consumers (technical and non-technical losses).

– The General Directorate of Mineral Research and Exploration being empowered to designate the fee and qualification of personnel working for outside mining and researching operations.

– Exclusions in the Turkish Coastal Law and Olive Law for nuclear power stations.

– Exclusions for nuclear power stations from scientific responsibility articles in the Constructions Inspection Law and Constructions Zoning Law, which mean these are inspected by institutions empowered by the Turkish Atomic Energy Authority.

– The Turkish Atomic Energy Authority being empowered to issue generation license to nuclear power plants prior to construction certificates and permissions regarding ownership.

– Coal mining licenses being prepared separately to electricity production without causing loss of resource reserve, with the Ministry of Energy and Natural Resource’s prior consent.

– Exclusions from the Public Tender Law for electric energy brought by the Turkish Electricity Trade and Contracting Corporation.

The full text of the Constitutional Court’s reasoned decision numbered 2016/150, dated 28 December 2017, was published in Official Gazette number 30333 on dated 15 February 2018 and can be found at this link (only available in Turkish).

Read More
Turkey Revises State Support Scheme for Trademark-Related Costs when Purchasing Foreign Companies

Turkey’s Money-Credit Coordination Board has amended the financial support scheme for market research and market entry. Changes apply particularly to trademark-related costs when purchasing foreign companies which are involved in advanced technology.

The Communiqué Amending the Communiqué on Market Research and Market-Entry Support (“Amendment Communiqué“) was published in Official Gazette number 30340 on 22 February 2018.

The Amendment Communiqué addresses provisions regarding purchasing foreign companies:

– A certain percentage of loan interest expenses will be reimbursed for trademark purchases, up to a total of $2 million:

– 5% of expenses for Turkish Lira loans.

– 2% of expenses for foreign currency and foreign exchange loans.

– Maximum 50% of the trademark purchase price will be considered when calculating the loan amounts to be provided as interest support.

– Preliminary approval will be required for expenses related to interest expenditures.

– Favourable provisions will apply to any applications which were not yet finalized by 22 February 2018.

Please see this link for full text of the Amendment Communiqué (only available in Turkish).

Read More
Turkey Updates Rules for Pharma Packaging and Patient Leaflets

The Turkish Medicines and Medical Devices Agency (“Agency”) updated the guidelines for packaging and patient leaflets related to human medicinal products. Changes primarily relate to how active ingredient should be indicated, as well as phrases which should be included on internal and external packaging.

Rules for packaging and patient leaflets for human medicinal products are contained in:

– The Guideline on Packaging Information and Patient Leaflets for Medicinal Products.

– The Guideline on Legibility of Medicinal Products’ Packaging Information and Patient Leaflets.

– The Guideline on Excipients in Packaging Information and Patient Leaflets.

Notable changes to the rules include:

– All products containing polymyxin group antibiotics must now indicate the active ingredients as I.U. or U.

– The authorization number is no longer required to be included on the inner packaging of a product’s first two series if production authorization was granted within the scope of localization.

– For products which have dry powder pharmaceutical form and which will be used by adding water, a notch or corresponding marking (such as a line) should be added to the inner packaging, to determine the correct amount of water to be added.

Please see this link for full text of the amendments (only available in Turkish).

Read More