New Exemptions from the Registration Obligation within the Scope of Turkish Data Protection Rules

Article by Ertuğrul Can Canbolat, Baran Can Yıldırım, and S.İrem Akın

Similar with what was experienced following the establishment of the Turkish Competition Authority, the Turkish Data Protection Authority ("DPA") has also been working very hard to ensure the establishment of a fair and equitable practice regarding the data protection regime for all relevant stakeholders. In this regard, the DPA has recently granted new exemptions to the registration obligation of the data controllers as regulated under Article 16/2 of the Law No. 6698 on Personal Data Protection) and the Regulation on Data Controller Registry. This article does not focus on the relevant legislation rather briefly explains the DPA's recent decisions in relation to the concerned obligation.

In May 2018, the DPA announced a decision¹ in which the following list of professions were granted exemption from the registration obligation in their operations: (i) data processors that process the data in a non-automated manner on the condition that they are part of a "filing system"², (ii) notaries, (iii) associations/foundations/unions³, (iv) political parties, (v) lawyers, and (vi) certified public accountants and sworn-in certified public accountants.

Shortly after the announcement of the above-mentioned decision, various stakeholders have requested that the DPA extend the professions which will enjoy the exemption from the registration obligation.

Within the same month of the announcement the Customs Brokers Associations (in İstanbul, Ankara, Bursa, İzmir, and Mersin) requested from the DPA to include "customs brokers" and "authorised customs brokers" to the exemption. Further, at the same period of time, the Turkish Justice Ministry's Department of Mediation requested that the mediators be included in the scope of the exemption. As a result of its evaluations, the DPA accepted the requests and resolved to broaden the scope of the concerned exemption in line with those requests.

In mid-July, the DPA on its own initiative narrowed the scope of the exemption by excluding the data controllers (either real person or legal entity) whose annual number of employees is less than 50 and whose annual balance is less than TRY 25 million.  On the other hand, it should be noted that the data controllers whose major area of activity is processing of special categories of personal data (i.e. any data revealing health, sexual life, criminal conviction, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, etc.)  are still subject to the registration obligation.

Finally, the DPA has established the deadlines for fulfilling the registration obligation as follows:

• The registration obligation of the data controllers whose annual number of employees is more than 50 and whose annual balance is more than TRY 25 million will begin on October 01, 2018 and those data controllers should register to the Data Controllers' Registry by September 30, 2019.
• The registration obligation of the data controllers located abroad will start from the date of October 01, 2018 and they should register to the Data Controllers' Registry by September 30, 2019.
• The registration obligation of the data controllers (i) whose annual number of employees is less than 50, (ii) whose annual balance is less than TRY 25 million, and (iii) whose major area of activity is processing of special categories of personal data will begin on January 01, 2019 and the concerned data controllers should register to the Data Controllers' Registry by March 31, 2020.
• The registration obligation of the data controllers who are public bodies or agencies will start from the date of April 01, 2019 and they may register by June 30, 2020.

In conclusion, the above-mentioned decisions of the DPA draw the boundaries of the application of the data protection law and bring certainty with regards to the registration obligation at least to some extent. On the other hand, it is undeniable that the Turkish data protection law practice still needs improvements. In this regard, we believe that lack of sufficient transparency to provide greater precision in the enforcement of the data protection legislation (e.g. lack of grounds for setting the limit to 50 employees/TRY 25 million, or choosing the concerned professions) may be brought to the attention of the Turkish courts.

Footnotes

1. DPA's decision dated 02.04.2018 and numbered 2016/32.

2. "Filing system" is defined as "any recording system through which personal data are processed by structuring according to specific criteria" under Article 3/)(h) of the Law

3. The exemption only covers those which are operating in compliance with the relevant legislation and which are processing personal data limited to their operations and only related to their own employees, members and donators.