The Communiqué on the Report on Independent Audit of Information Systems and Business Processes (‘‘Communiqué’’) drafted by the Banking Regulation and Supervision Agency has been published in the Official Gazette dated March 25th, 2022, numbered 31789, and entered into force on the same date. Pursuant to the Communiqué, the Communiqué on the Report on Independent...

The Constitutional Court Decision dated 03.02.2022 and numbered 2019/20473 published in the Official Gazette dated 18.03.2022 and numbered 31782 (“Decision”) pertains to the allegation that right to request the protection of personal data within the scope of the right to respect to privacy has been violated. The allegations of the applicant (“Applicant”) are as follows:...

The Regulation on the Structure and Activities of the Türkiye Health Data Research and Artificial Intelligence Applications Institution (‘‘Regulation’’) has been published in the Official Gazette dated 12 March 2022 and entered into force on the same date. With the Regulation, the establishment, structure, duties, authorities, working principles and procedures of the Türkiye Health Data...

Communiqué (Communiqué No: 2022/2) (“Communiqué”) Amending the Communiqué on Mergers and Acquisitions (Communiqué No: 2010/4) (“Communiqué No: 2010/4”) Requiring Permission from the Competition Board has been published in the Official Gazette dated 04.3.2022 and numbered 31768. With the Communiqué, the turnover thresholds based on the notification in terms of merger and acquisition transactions have been...

The Regulation on the Protection and Processing of Data Before the Social Security Institution (‘‘Regulation’’) has been published in the Official Gazette dated February 19th, 2022 and entered into force on the same date. In the Regulation, the procedures and principles to be complied with in the processing of the data obtained by Social Security...

The technical and administrative measures recommended to be taken by Data Controllers regarding user security were announced on the website of the Personal Data Protection Authority (“Authority”) on 15.02.2022. Pursuant to Article 12, paragraph 1 of the Personal Data Protection Law, the data controller is obliged to take all necessary technical and administrative measures to...

On January 11th, 2022, Personal Data Protection Authority (‘’Authority’’) has published a ‘’Draft Guideline on Cookie Policies’’ (‘’Guideline’’) on its website. The Authority presented the guideline to the public until February 10th, 2022, in order to have opinions of the related parties. Accordingly, opinions and evaluations regarding the Guideline may be sent to the Authority...

The Principle Decision of the Personal Data Protection Board (‘’Board’’) dated 23 December 2021 and numbered 2021/1304 regarding blacklisting applications in the car rental sector was published on Official Gazette dated 20 January  2022 and numbered 31725.  As a result of the investigations carried out by the Personal Data Protection Board (“Board”) within the scope...

A consumer resorted to the consumer arbitration committee for a refund, claiming that a defective product was delivered to her, after she found a cigarette stub in the truffle package which she purchased from www.ciceksepeti.com.  Following the acceptance of the consumer’s request by the consumer arbitration committee, Çiçeksepeti requested the annulment of the consumer arbitration...

The Personal Data Protection Board (“Board”) rendered a decision dated 30/09/2021 and numbered 2021/989 (“Decision”) on the use of the picture of the data subject in the news content on a website without an explicit consent.   Pursuant to the Decision, it is stated by the guardian of the data subject that the data controller...