1) PUBLIC ANNOUNCEMENT ON THE DISTANCE EDUCATION PLATFORMS -07/04/2020-
It is seen that personal data such as names and surnames of the students and some personal data of special nature that can be evaluated as biometric data such as voice and image are processed in the distance education platforms. At this point, personal data shall be processed in accordance with the conditions specified in article 5 and/or article 6 of the Law on the Protection of Personal Data (“Law”).
However, it is seen that most of the software were used for distance education services through cloud service providers and the data centers of these service providers are mostly abroad. In case of using platforms with service providers abroad, transfer of personal data shall be occured. Therefore, it should not be forgotten that transfers that do not perform the conditions in article 9 of the Law may be evaluated as a violation of the Law.
In this context, in association with whether these platforms used for distance education service are taking necessary data security measures or not, necessary examinations shall be carried out.
2) PUBLIC ANNOUNCEMENT ON THE PROCESSING OF LOCATION DATA AND TRACKING OF MOBILITY OF PERSONS IN THE COMBATING AGAINST COVID19 -09/04/2020-
In accordance with the article 28 of the Law, in case personal data is processed within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations duly authorised and assigned to maintain national defence, national security, public security, public order or economic security, it is ruled that the provisions of the Law shall not be applied.
Based on this point, data processing activities to be carried out by the authorized public institutions and organizations for in cases that threats public order and public safety such as epidemic disease,
– Isolation of people who have been diagnosed with epidemic disease in order to prevent this threat,
– To identify crowded areas by processing location data of the general population and in this context, to develop measures, data processing activities to be carried out by authorized public institutions and organizations are evaluated within the scope of the article metnioned above of the Law.
In this framework, due to the epidemic caused by Covid-19 that threats public safety and public order, there is no obstacle to the processing of location data by public institutions and organizations that fall under the scope of the mentioned article in order to prevent the spread of the disease.
On the other hand, in the procedure of processing the location data of persons by associating with their health status, taking into consideration that if such data is obtained by third parties, serious damages may arise for the data subject, all necessary measures shall be taken.
3) PUBLIC ANNOUNCEMENT ON BINDING CORPORATE RULES -10/04/2020-
As known, the Personal Data Protection Board (“Board”) has determined one of the methods that allow the parties to guarantee to provide sufficient protection in writing as “Commitments” in case transfer of personal data to the data controller/data processor resident in countries where there is not enough data protection. The Board also prepared and announced the minimum elements that should be included in the Commitments to be prepared by the parties and submitted to the Board for approval. In this context, it is possible to transfer data abroad after the commitments are approved by the Board.
However, while these commitments facilitate bilateral data transfers which is generally between companies, it may be insufficient to provide implementation practice in terms of data transfers between international group companies. Therefore, “Binding Corporate Rules” have been determined as another method by the Board to be used in the international data transfers to be carried out. Binding Corporate Rules are data protection rules to be used for the transfer of personal data abroad for international group companies operating in countries where sufficient protection is not available and that ensures to guarantee to provide sufficient protection in writing. Companies within this scope shall apply to the Board for Binding Corporate Rules by filling the form at www.kvkk.gov.tr and following the necessary instructions. The Board also stated the basic issues that shall be in the binding corporate rules as it is in the commitment process by publishing a document.