What Are The Exceptions to Obligation Of Enrolment in Data Controller Registry? 31 January 2018
As is known; the Law on Protection of Personal Data numbered 6698 (“the Law”) determines a general framework with its regulations regarding the protection of personal data, but it leaves the detailed determination of the matters in this frame to the regulations which are secondary legislation. Within this scope; some of these regulations have been regulated. One of them is the Regulation on Data Controller Registry which was published in the Official Gazette dated 30.12.2017 and numbered 30286 and has been come into force on the date of 01.01.2018 (“the Regulation”).
According to Paragraph 2 of Article 16 of the Law; natural or legal persons who process personal data shall be obliged to enroll in the Data Controller Registry before proceeding with data processing. Also, it is regulated in second sentence of the same Paragraph that an exception may be provided to the obligation of enrolment in the Data Controller Registry by taking the some objective criteria into consideration.
The Regulation stipulates the principle and procedures regarding the structuring of the Data Controller Registry and management of it as well as the registrations that shall be made into the Data Control Registry. Within this framework; it has been regulated that the Data Controller Registry shall be kept publicly accessible by the Presidency of Personal Data Protection Board under the supervision of the Personal Data Protection Board (“Board”).
Article 9 of the Regulation has been regulated in similar way with Paragraph 2 of Article 16 of the Law and it is stated that data controllers are obliged to enroll in the Data Controller Registry before proceeding with data processing. If data controllers who are not under the obligation to enroll in the Data Controller Registry become obliged to enrolment, they shall register to the Data Controller Registry within 30 (thirty) days following the commencement date of such obligation. Additionally; the information system which will be used by data controllers while applying to the Data Controller Registry and for other transactions which can be reached via internet is called as Data Controllers Information System (“VERBIS”).
However; criteria are counted in Article 16 of the Regulation which can be taken into account by the Board in order to provide an exception to obligation to enroll in the Data Controller Registry. Accordingly; Board can remove the obligation of some of the data controllers to enroll in the Data Controller Registry by considering the following objective criteria:
- Qualification of personal data
- Number of personal data
- Purpose of processing personal data
- Field of activity that personal data is processing
- Transferring situation of personal data to third persons
- Legal requirement of personal data processing
- The time of period of being retained of personal data
- Group of personal data subjects or data categories
It is stated under Paragraph 2 of the same article that the Board shall declare its resolutions taken in order to determine the scope of the exceptions which are specified within the extent of the abovementioned criteria to the public with proper methods as well as application procedures and principles of such resolutions.
However; neither the Data Controller Registry nor VERBIS are brought into service at present. Therefore; the obligation of enrolment in the Data Controller Registry has not started yet for the data controllers. Moreover; no announcement has been made by the Board regarding the exception of enrolment in the Data Controller Registry which is envisaged in Article 16 of the Regulation.
In the light of these explanations; in order not to face with administrative fines ranging between 20.000,-TL and 1.000.000,-TL envisaged in the Law and the Regulation which will be applied to the data controllers who fail to enrolment and notification obligation in the Data Controller Registry, following the relevant legislation closely via professionals has a big importance for real and legal persons who process personal data in order not to miss time limit regarding the enrolment obligation as well as they shall make stipulated that whether they are in the scope of the exceptions of the enrolment obligation.
Türkçe Versiyonu İçin
http://www.kasaroglu.av.tr/tr/veri-sorumlulari-siciline-kayit-zorunlulugunun-istisnalari
