İpek Koray

Avukat

20.08.2021

CONDITIONS REQUIRED FOR THE TRANSFER OF PERSONAL DATA ABROAD WITHIN THE CONTEXT OF KVKK

The transfer of personal data abroad within the context of the Law on the Protection of Personal Data No. 6698 is regulated as a separate provision in Article 9 of the relevant law, since it is more risky than the transfer of data within the country. As understood from the transfer of personal data abroad and the processing of data being subject to the same conditions in the law, data transfer is considered as a type of data processing in the KVKK.
 
To procure the transfer of personal data abroad under the KVKK, it is necessary to fulfil the conditions stated in Article 9. Within the scope of Article 9 of the KVKK, the explicit consent of the person must be obtained for data transfer abroad or the parties must provide adequate protection in writing and the transfer must be allowed by the Commission.
 
I.          Obtaining Explicit Consent in Data Transfer Abroad
As understood from the wording of Article 9 of the Personal Data Protection Law, the explicit consent of the person is prioritized in data transfer abroad. In the case that the person has explicit consent for the transfer of personal data abroad, the data can be transferred without searching for other conditions and assurances stated in Article 9. For the explicit consent to transfer personal data abroad, besides the general conditions designated under the KVKK, there should be elements such as the country to be transferred, the purpose of the transfer, and whether the person receiving the data will transfer the data to another person or country after the transfer. To sum up, in order for a valid explicit consent to be mentioned pursuant to the law numbered 6698, the person must know what the explicit consent is about and which data will be transferred to where and under what conditions with this consent.
 
II.          Data Transfer Abroad without the Explicit Consent
As given above in Article 9 of Law No. 6698, the primary condition for data transfer abroad is to obtain the explicit consent of the person. However, in the respective article of the law, the legislator, taking into account the fact that there are mandatory circumstances during the data transfer procedure, has also ensured that data transfer can be made without the explicit consent of the person in this case.
 
In states anticipated to be able to transfer data without obtaining explicit consent, the form of the personal data to be transferred should be identified first. At this point, it is identified whether the personal data to be transferred is general personal data or special personal data. "Verdicts in other laws regarding the transfer of personal data abroad are reserved." verdict takes part in Article 9/6 of the KVKK, regarding the transfer of general personal data abroad. Even in the case that there is no explicit consent of the person in order to procure the transfer of a general personal data abroad; In accordance with the fact that data transfer gets by upon a legal verdict, this situation will be considered as a state of compliance with the law, so data transfer abroad can be ensured. The processing conditions of personal data are touched on in Article 5 of the Law No. 6698, and the processing conditions stated in the respective article are also a related verdict in the transfer of data abroad, in accordance with the Article 9/6 of the KVKK. The stance of compliance with laws, which we have touched on pursuant to the wording of the verdict in question, are important in terms of providing data transfer without explicit consent, and it is necessary to designate these cases in general terms in accordance with Article 5 of the KVKK;
⮚     Circumstances Explicitly Anticipated in Laws
⮚     Factual Impracticability
⮚     Drawing Up and Fulfilment of a Contract
⮚     Legal Obligations of the Data Controller
⮚     Data Being Made Public
⮚     Establishment and Protection of a Right
⮚     Legitimate Interests of the Data Controller
 
In the existence of aforementioned cases, it is assumed that there is a state of compliance with laws for data transfer and explicit consent should not be sought. To sum up, if the data to be transferred is a special personal data, the conditions listed in Article 6, if it is general personal data, the conditions listed in Article 5 must exist. 
 
Supplying Adecuate Protection in Personal Data Transfer
Once transfer is done based on one of the cases other than explicit consent, it is crucial to supply adecuate level of protection in addition to the data processing condition. To able to state that there is adequate protection, the country to which the data will be transferred must be accepted by the Commission as one of the countries with adequate protection; The Commission is obligated to be convenient to the "criteria to be taken as a basis for designating countries with adequate protection". In the case that the country in which the data will be transferred is not one of the countries with adequate protection, a commitment regarding the existence of adequate protection has to be given by the domestic data controller and the data controller abroad. The commitment to the existence of adequate protection must be in writing. 
 
As a matter of fact, in the Commission's decision dated 02.05.2019 and numbered 2019/125, the following provision was established and clearly stated the principles regarding the "Criteria to be Used in Designating the Countries with Adequate Protection" and the country designation criteria; “As known, in Article 9 of the Law on the Protection of Personal Data (Law) No. 6698, personal data cannot be transferred abroad without the explicit consent of the person in question, and in case that there is adequate protection in the foreign country to which the personal data will be transferred to or there is no adequate protection, it is decided that the data in question can be transferred abroad without searching for the explicit consent of the data subject, provided that the data controllers in Turkey and in the relevant foreign country guarantee in writing to an adequate protection and the permission of the Personal Data Protection Commission (Commission). Farther, the article ensures that the countries with adequate protection will be designated and declared by the Commission and the matters to be evaluated in the declaration of the respective countries.
 
As such, access to the respective criteria postulated in the Commission's Decision dated 02/05/2019 and numbered 2019/125 to be used by the Commission in designating the countries with adequate protection in accordance with the Article 9 of the Law can be accessed via the reference given above at the beginning of the paragraph.”
 
The points to be ensured for the commitment to be effectual are that the commitment must be in writing, it must be received both from Turkey and abroad, and the commitment must be initially approved by the Commission. If there is more than one recipient in the data transfer, each data recipient must supply a written commitment. In brief, in the case that the country to in which the data will be transferred abroad is not a country with adequate protection, the transfer can only be ensured on the condition that the data controllers in Turkey and abroad undertake adequate protection in writing and receive permission from the Commission. 
 
Unfortunately, adequate legal arrangements have not been made within the context of KVKK in our country yet. Due to the fact that the countries with adequate protection and the transfer of personal data abroad under the GDPR (General Data Protection Regulation), which is based on the regulation of the local legislation in the protection of personal data, have not been declared by the Commission, there is an order proceeding in the direction of the Commission decisions at this point of time. Yet, if we sum up the entire subject pursuant to the current decisions, either the explicit consent of the person in question is required for a data transfer to be made abroad in general terms; or there must be a written commitment regarding adequate protection in line with the aforementioned conditions and the permission of the Commission must be received in order to transfer accordingly.