Recent Developments On Personal Data Protection In Turkey (April – May 2019): Microsoft's Data Breach, Facebook's Violation, And More

Introduction

Turkish personal data protection practice presented some noteworthy developments in April and May 2019 as the Turkish Data Protection Authority ("DPA") published through its website several summaries of its recent decisions shedding light on issues such as "legitimate interest of the data processor", "explicit consent", "obligation to inform", and "data security". The DPA also published a new guideline on the "Personal Data Processing Inventory".

Particularly, the DPA announced that Microsoft notified the DPA about a data breach occurred in Microsoft's systems. Microsoft was not fined as it reportedly took necessary security measures to prevent further breaches. On the other hand, the DPA fined Facebook on the grounds that Facebook failed to notify the DPA about an API bug, which led to unauthorized access by third-party applications to the Facebook users' photos and Facebook's security measures are not sufficient to prevent such breach, and to