Amendments To Code No. 6698 On Protection Of Personal Data And To Time Limits

3/14/2024
Law No. 7499 on the Amendment to the Code of Criminal Procedure and Certain Laws (“Amendment to the Code”), also known as 8th Judicial Package, has been published in the Official Gazette dated March 12, 2024.
Amendment to the Code, which introduces essential amendments to certain codes of law, includes amendments to (i) Code No. 6698 on the Protection of Personal Data (“Code”) in relation to processing special categories of personal data, transferring personal data abroad, and to the competent court in litigations against administrative fines imposed by the Personal Data Protection Board; alongside with (ii) time limits for legal remedies with the objective of standardizing periods specified in various laws in terms of days and weeks.

1. Amendments to Code No. 6698 on the Protection of Personal Data

Alterations introduced by Amendments to the Code can be grouped under three headings:
  • Conditions for processing special categories of personal data has been changed,
  • Conditions for transfer of personal data abroad has been determined,
  • Administrative courts have been determined as competent court in litigations against administrative fines imposed by the Personal Data Protection Board.

a. Conditions for processing special categories of personal data has been changed
Prior to Amendment to the Code, special categories of personal data not related to health and sexual life (e.g., race, religion, and political opinions) could be processed without the explicit consent of the individual. Under the new regulations, the processing of personal data of special categories is subjected to the following conditions:

i.  Explicit consent of the data subject,
ii. Express permission of any law,
iii.Necessity to protect the vital interests of the data subject or another person when the data subject is physically or legally incapable of giving consent due to actual impossibility,
iv. Processing being related to personal data made public by the data subject and being in accordance with the intention of publication,
v.  Necessity for the establishment, exercise, or defense of a legal claim,
vi. Necessity for the protection of public health, including preventive medicine, medical diagnosis, treatment and care services, as well as for the planning, management, and financing of health services, carried out by individuals subject to the obligation of confidentiality or authorized institutions/organizations,
vii. Necessity for the fulfillment of legal obligations in fields of employment, occupational health and safety, social security, social services, and social assistance,
viii. Processing being aimed at current or former members and affiliates of foundations, associations, or other non-profit organizations (also pertinent to individuals who are in regular contact with such organizations) established for political, philosophical, religious, or labor union purposes, provided that they comply with the relevant legislation and their objectives, are limited to their field of activity, and are not disclosed to third parties.

b. Conditions for transfer of personal data abroad has been determined

Amendment to the Code provide a system with three alternatives for the transfer of personal data abroad. Accordingly;

i. Personal data may be transferred abroad given that one of the conditions specified in Articles 5 and 6 of the Code exists and there is an adequacy decision about the target country, international organization or sectors within the target country (Art. 9/1-2-3).
ii. In absence of an adequacy decision, personal data may be transferred abroad if one of the conditions specified in Articles 5 and 6 of the Code exists, provided that the data subject has the opportunity to exercise his/her rights and to apply for effective legal remedies in the target country, and if one of the appropriate guarantees in paragraph 4 of Article 9 of the Code is ensured.
iii. In absence of an adequacy decision and appropriate guarantees, personal data could be transferred abroad in the case of one of the conditions in paragraph 6 of Article 9 of the Code exists, provided that the transfer is temporary.

In accordance with these regulations, companies established abroad and providing services on a global scale will be able to transfer personal data abroad, provided that they meet the adequacy conditions set forth in the Code.

c. Administrative courts have been determined as competent court in litigations against administrative fines imposed by the Personal Data Protection Board

Prior to Amendment to the Code, the applicable jurisdiction for litigating against administrative fines imposed by the Personal Data Protection Board was not explicitly regulated in the legislation. Consequently, by virtue of the Misdemeanours Law, Criminal Judgeships of Peace were deemed competent, and related lawsuits were initiated before these courts.

With the Amendment to the Code, the competent court has been explicitly defined, and it has been established by law that administrative courts are vested with jurisdiction over disputes concerning administrative fines imposed by the Personal Data Protection Board.

2. Amendments to the Time Limits for Legal Remedies

Previously, within various statutes, the time limits for lodging objections, appeals, and applications for cassation were inconsistently defined, with some legislations specifying days and others weeks, leading to disparate periods for submissions. Amendment to the Code has standardized these periods to two weeks, thereby ensuring uniformity.

Furthermore, the practice of initiating the period for legal remedies upon the pronouncement of the decision in court (pronouncement to the parties) has been abolished. It has been decided that such periods will now commence upon the notification of the reasoned decision.

The amendments, which will apply to decisions issued after June 1, 2024, have effected changes in the following codes:
  • Code No. 2004 on Enforcement and Bankruptcy
  • Code No. 4675 on Execution Judgeships
  • Code No. 5271 on Criminal Procedure
  • Code No. 5326 on Misdemeanours
  • Code No. 5395 on Child Protection
  • Code No. 6100 on Civil Procedure
  • Code No. 6502 on Consumer Protection
Please do not hesitate to contact us if you have any questions regarding above matters.