Data Controller Information System 10 September 2019
As is known, under Turkish Personal Data Protection Law (“Law”), a number of obligations have been introduced to the data controller who is defined as the natural person or legal entity who establishes manages a personal data recording system or processes the personal data recording system.
In addition to the obligations, such as fulfilment of the obligation to inform data subject and the provision of data security, one of the obligations currently on the agenda is the obligation to register with the Data Controller Registry Information System (“VERBIS”) due to the limited time given for registration.
The procedures and principles regarding the registration to VERBIS are regulated in the Regulation on the Data Controller Registry (“Regulation”) which is entered into force on 01.01.2018. Some data controller groups are exempted from the obligation to register with VERBIS in accordance with certain criteria regulated under the law and the regulation. Within this scope, Personal Data Protection Board (“Board”) determined data controllers who are exempted from this obligation with their decisions dated 02.04.2018 no. 2018/32, and dated 05.07.2018 no. 2018/75, and dated 19.07.2018 no. 2018/87 are listed below:
- Data collectors who process data in non-automatic ways
- Notaries
- Political parties
- Lawyers
- Certified public accountants and freelance public accountants
- Associations and foundations under certain conditions
- Customs brokers
- Mediators
- Data controllers with less than 50 employees per year and total annual financial balance less than 25 million TL, or legal entities, whose main activity is not sensitive personal data processing, are not obligated to register with VERBIS.
Which Data Controllers Are Liable to Register with VERBIS?
Data controllers who are not included in the scope of exemptions stated above are liable to register with VERBIS. Under the decision of the board dated 07.09.2019 no. 2019/265 and published in the Official Gazette no. 30881, the time period to register with VERBIS is extended until 31 December 2019 for:
- Data controllers with more than 50 employees per year or total annual financial balance exceeding 25 million TL,
- Non-resident data controllers.
In addition the above-mentioned data controllers;
- Data controllers whose main activity is sensitive personal data processing, although their number of employees is less than 50 and the total annual financial balance is less than TL 25 million TL are required to register with VERBIS until 31 March 2020.
- Public institutions and organizations are required to register with VERBIS until 30 June 2020.
For the fulfilment of the obligation to register with VERBIS, it is mandatory to provide complete information including the details of the processing of the data, the purpose of processing personal data, the identity of the data controller, the recipient groups to which the data will be transferred.
Is There A Penalty for Failing to Comply with the Obligation to Register with VERBIS?
The Personal Data Protection Board determined an administrative fine of 20,000 TL to 1,000,000 TL for those who fail to comply with the obligation to register with VERBIS until the dates mentioned above.
In addition, the breach of the obligation to inform the system during registration; in other words, if the information requested is incomplete or incorrect, administrative fine up to 100,000 TL is regulated in the law. Failure to comply with data security obligations and Board decisions are also subject to an administrative fine up to 1,000,000 TL.
Within this scope, it is crucial to strictly comply with the time periods of registration obligation according to the data group included, and it is absolutely necessary to get support from experts in order to fulfil the registration obligation to VERBIS as required.
