PROCESSING PERSONAL DATA AND PROTECTION OF PRIVACY IN THE ELECTRONIC COMMUNICATION SECTOR 26 January 2021

Within the scope of the Regulation on The Processing of Personal Data and the Protection of Privacy in the Electronic Communication Sector ("Regulation") published in the Official Gazette dated 4 December 2020 and numbered 31324; the procedures and principles to be followed by the operators operating in the electronic communications sector in terms of the data they obtain within the scope of providing electronic communication services including legal person subscriptions are regulated. In terms of the Regulation, the company that provides electronic communication services and/or provides electronic communication network and operates its infrastructure is defined as "Operator". The natural person or legal entity who is a party to a contract made with an Operator for the provision of electronic communications service is defined as a “Subscriber”. And the natural person or legal entity who benefits from electronic communication services regardless of subscription or not is defined as "User".

In accordance with this Regulation; it is stipulated that personal data should be processed in accordance with the law and good faith, be accurate and up-to-date when necessary, processed for specific, clear and legitimate purposes, related, limited and measured for the purpose for which they were processed, and kept for the period stipulated in the relevant legislation or required for the purpose for which they were processed. At the same time, it is essential not to take traffic and location data abroad for national security reasons.

1. WHAT ARE THE OBLIGATIONS OF OPERATORS?

1. Measures Regarding the Security of Personal Data

Some obligations have been imposed on the Operators within the scope of the provisions of the Regulation. In this context, operators will take all necessary technical and administrative measures in accordance with the Electronic Communications Law, Personal Data Protection Law, national and international standards in order to ensure the security of personal data belonging to their subscribers/users and the services they provide. Operators will determine security policies regarding the processing of personal data, protect personal data against violations, ensure that personal data can only be accessed by authorized persons and ensure the security of the systems and applications used to access personal data. In cases deemed necessary by the Information and Communication Technologies Authority, information and documents may be requested from the Operators regarding the security measures taken by the Operators, and also, without prejudice to the right to apply administrative sanctions, changes in the said security measures may be requested. In addition, Operators are obliged to keep transaction records regarding access to personal data and other related systems for two years.

2. Notification of Security Risks and Personal Data Violations

Pursuant to the Regulation, Operators are obliged to inform the relevant subscribers as soon as possible about the scope of the risk and the methods to eliminate this risk in case of a certain risk threatening the security of their networks and the services they offer. And at the same time, in case of a personal data violation, it is obliged to notify the Personal Data Protection Authority and related subscribers/users as soon as possible in accordance with the Personal Data Protection Law and related legislation.

3. Ensuring Conditions Regarding Explicit Consent

Operators are obliged to fulfill the conditions specified in the Regulation in cases where explicit consent from the subscriber/user is required. Accordingly, the explicit consent declaration must be taken before the relevant transaction and in relation to a specific issue. General consents that are not limited to a specific subject and not limited to the relevant transaction will be void.

In addition, it is mandatory to provide clear and understandable information about the type of personal data to be processed by the operators and the types of traffic and location data, its scope, purpose and duration before the explicit consent statement is received from the subscriber/user. Furthermore, the explicit consent declaration must be explained with free will. Accordingly, establishing a subscription and providing basic electronic communication services or devices cannot be bound by the precondition of giving explicit consent to the processing of the data of the subscriber/user. However, in accordance with the Regulation, it has been accepted that explicit consent can be requested from the subscriber/user in exchange for additional benefits such as gift minutes, SMS and data. Nevertheless, while applying this provision, it should be kept in mind that limited and measured consent must be obtained for the purpose of processing and for a legitimate purpose in accordance with the good faith.

2. WHAT ARE THE OPPORTUNITIES PROVIDED TO SUBSCRIBERS?

The operators will provide the caller with a simple method and free of charge to hide her/his number and to prevent the caller number from being displayed on incoming calls.

By the operators, the subscriber/user will be given the opportunity to stop the automatic redirects from third parties with free and simple methods. In the event that redirects to another number or automatic message system are paid, the approval of the subscriber/user will be obtained. The operators are also obliged to ensure that some numbers of the phone numbers included in the usage details or detailed invoices are concealed upon the request of the subscribers.

Operators will always allow the subscribers/users to withdraw their explicit consent given by text message, call center, internet and similar methods free of charge with the same method or a simpler method. And the information regarding this opportunity will be made during the explicit consent. In addition, it is stipulated that the operators will inform the subscribers/users that their data has been processed within the scope of their explicit consent previously received via text message, e-mail or one of the calling methods. If no notification is made, the data processing activity within the scope of the explicit consent given before is stopped until the notification is made.

In case the subscription is terminated, as of the expiration date, all explicit consents previously given will be deemed to be withdrawn unless the subscriber's request otherwise. All the information to be made to the subscribers within the scope of the Regulation will be made free of charge and the responsibility of proof regarding these notifications, explicit consent, subscription request and approval belongs to the Operator. In the event withdrawal of explicit consent, data processing activities based on explicit consent are immediately stopped by the Operator.

3. VALIDITY OF EXPLICIT CONSENTS

Pursuant to this Regulation, which will come into force six months after its publication; Consents obtained in accordance with the law before the date on which the Regulation came into force will be considered valid. However, it should be taken into consideration that the validity here should be evaluated separately from the scope of the Law on Protection of Personal Data.

In the event that the data of the parties whose data is processed by obtaining their consent before the effective date of the Regulation continue to be processed without their explicit consent despite their subscription termination; it has been determined that this process will be suspended within one month following the effective date of this Regulation.