Turkish Personal Data Protection Board ("Board")
published five (5) new decision summaries on the Data Protection
Authority's ("DPA") website on July 17, 2019.
I. Use of Private E-Mail Services for Corporate E-Mail
Addresses (Board's Decision 2019/157)
Board's decision of May 31, 2019 with number 2019/157 has
been rendered in response to a request from a data controller for
Board's guidance on the matter of whether a private e-mail
service, provided by a foreign company, can be used for corporate
e-mail addresses obtained through an open source e-mail
service.
The Board stated that the e-mail messages sent or received
through the relevant e-mail addresses using the relevant private
e-mail service's infrastructure might be stored in data centers
located in different parts of the world and therefore, personal
data would be deemed to be transferred abroad. Accordingly, the
Board concluded that data controllers willing to use the relevant
private services shall do