Decision On Transfer of Personal Data Abroad Based On the Agreement Numbered 108
An important decision was issued on 22/07/2020 by the Personal Data Protection Board (“Board”) concerning companies that transfer personal data abroad. Within the scope of this decision, the procedures and principles regarding the transfer of personal data abroad according to the Agreement numbered 108 (“Agreement”) and restrictions regarding the transfer abroad stipulated under the Personal Data Protection Law Numbered 6698 (“PDPL”) were clarified further while evaluating the legal status of the provisions of the Agreement.
As per the decision;
• Since being a party to the Agreement is not sufficient by itself for the determination of safe countries, transfer of personal data to foreign countries without obtaining explicit consent of the data owner will be deemed as a violation of the provisions specified under the article 9 of the PDPL. While obtaining the explicit consent of the data owner, a clear statement regarding the data which will be transferred abroad must be included in the informative letter to be presented and the data owner must knowingly give consent to such data processing activity to be carried out by the data controller.
• Therefore, as a consequence of basing on the grounds of the Agreement only, illegal personal data processing activities are carried out by transferring personal data abroad due to the lack of necessary conditions, and in this case, the obligation to prevent the illegal processing of personal data under the PDPL has not been fulfilled.
• In addition, the data controller has been instructed to delete or destroy the personal data in accordance with the PDPL which were illegally transferred abroad and to inform the Board regarding the results.
Upon these decisions, the Board offered an insight on how the provisions of the PDPL regarding the transfer of personal data abroad will be applied to the present cases and to which data controllers should pay attention when transferring personal data to foreign countries. In this context, the Board emphasized that the transfers to the foreign countries which are not declared as safe countries can only be fulfilled in case certain situations regulated under the PDPL exist, a permit is granted by the Board and parties guarantee an adequate protection in writing. In addition, it is clarified that there is currently no other way than obtaining explicit a consent from data owners that their personal data will be transferred abroad since the Board emphasized that no country is currently considered as a safe country and it takes time to finalize the applications regarding personal data transfer abroad. Moreover, the decision is important to resolve the discussions regarding the Agreement since the Board confirmed that the Agreement alone is not sufficient for the transfer of personal data abroad.