Turkey's Data Protection Board Publishes Summarised Rulings

Turkey's Data Protection Authority has published a number of recent decisions by the Data Protection Board ("Board"). The summarized and anonymized decisions help to clarify legislation and practices in this developing area, giving some insight on how the Board will treat certain aspects of data processing, transfers, and security breaches.

Notable points from the decisions include:

• The Board ruled that notifying data subjects about a breach of personal data security 17 months after the breach exceeds the reasonable period, constituting a breach of data security.
• Obtaining explicit consent from data subjects in circumstances where explicit consent is not required (circumstances outlined under Article 5(2) of the Law) constitutes an abuse of rights by the data controller.