Turkish Data Protection Board States That The Convention 108 Is Not Sufficient Per Se For Data Transfer Abroad

Turkey's Data Protection Board ("Board") imposed an administrative fine in the amount of TRY 900,000 on a data controller for transferring personal data abroad without having a valid legal basis. The data controller's claim that Convention 108 is sufficient per se for data transfer abroad among the parties has been declined by the Turkish Data Protection Board.

Upon a data subject's complaint on sending an unsolicited marketing message by the data controller operating in the automotive sector; the Board carried out an investigation. As the bulk messaging system that the data controller used is a web-based software, personal data were transferred to a cloud database located in an EU country for marketing text messages to be sent to data subjects. Therefore, the main dispute was concentrated on whether data were processed and transferred abroad in compliance with Turkey's Personal Data Protection Law number 6698 ("DP Law") or not.