The Regulation on the Protection and Processing of Data Before the Social Security Institution (‘‘Regulation’’) has been published in the Official Gazette dated February 19th, 2022 and entered into force on the same date. In the Regulation, the procedures and principles to be complied with in the processing of the data obtained by Social Security...

The technical and administrative measures recommended to be taken by Data Controllers regarding user security were announced on the website of the Personal Data Protection Authority (“Authority”) on 15.02.2022. Pursuant to Article 12, paragraph 1 of the Personal Data Protection Law, the data controller is obliged to take all necessary technical and administrative measures to...

On January 11th, 2022, Personal Data Protection Authority (‘’Authority’’) has published a ‘’Draft Guideline on Cookie Policies’’ (‘’Guideline’’) on its website. The Authority presented the guideline to the public until February 10th, 2022, in order to have opinions of the related parties. Accordingly, opinions and evaluations regarding the Guideline may be sent to the Authority...

The Principle Decision of the Personal Data Protection Board (‘’Board’’) dated 23 December 2021 and numbered 2021/1304 regarding blacklisting applications in the car rental sector was published on Official Gazette dated 20 January  2022 and numbered 31725.  As a result of the investigations carried out by the Personal Data Protection Board (“Board”) within the scope...

A consumer resorted to the consumer arbitration committee for a refund, claiming that a defective product was delivered to her, after she found a cigarette stub in the truffle package which she purchased from www.ciceksepeti.com.  Following the acceptance of the consumer’s request by the consumer arbitration committee, Çiçeksepeti requested the annulment of the consumer arbitration...

The Personal Data Protection Board (“Board”) rendered a decision dated 30/09/2021 and numbered 2021/989 (“Decision”) on the use of the picture of the data subject in the news content on a website without an explicit consent.   Pursuant to the Decision, it is stated by the guardian of the data subject that the data controller...

Personal Data Protection Board (“Board”) rendered a decision (“Decision”) dated 30/09/2021 and numbered 2021/993 on the issuing an inadvertent invoice on behalf of the data subject by the data controller courier company.  Pursuant to the Decision, although the data subject have not been provided any services from the data controller, an invoice has sent to...

The Personal Data Protection Board (“Board”) rendered a decision dated 16.09.2021 and numbered 2021/925 (“Decision”) on the unlawful obtaining and sharing of the union membership information of the data subject. Pursuant to the Decision, it is stated by the data subject that the union membership information and membership dates of the data subject and other...

Minimum equity obligation amounts for payment institutions and electronic money institutions have been amended with the Communiqué published in the Official Gazette dated 22 January 2022 and numbered 31727 (“Communiqué”). With the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (“Regulation”) published in the Official Gazette dated 1.12.2021 and numbered 31676,...

The Regulation on the Independent Audit of Information Systems and Business Processes (“Regulation”) was published in the Official Gazette dated 31.01.2022 and numbered 31706. The Regulation regulates the procedures and principles regarding the auditing of the information systems and business processes of the institutions under the supervision and control of the Banking Regulation and Supervision...