11 Recent Decisions Of The Personal Data Protection Board

The following are summaries of 11 recent Personal Data Protection Board (the "Board") decisions published on 2 August 2021:

• Decision No. 2019/170: a fine of TRY 50,000 was levied on data controller. Board findings: (i) data breaches were detected nearly one year after occurrence due to lack of internal controls, including transaction logs and breach notification systems, or ineffective implementation thereof, (ii) inclusion of personal data in third party URLs indicates either insufficient testing during webpage design or no testing at all.
• Decision No. 2020/113: a fine of TRY 200,000 was levied on data controller. Board findings: (i) prior to the data breach, data controller's systems were accessible without restriction via shared public WiFi points outside of data controller's control (e.g., coffeehouses) (ii) data breach tests were performed only post-breach (iii) vulnerabilities that could allow unauthorized access to critical information maintained by data