“National Artificial Intelligence Strategy 2021-2025″, which drafted in cooperation with the Digital Transformation Office of the Presidency of the Republic of Turkey and the Ministry of Industry and Technology announced on 24.08.2021. With the publication of the National Artificial Intelligence Strategy (“NAIS”), which is the first national strategy document of our country on artificial intelligence...

“The Presidential Circular on the National Artificial Intelligence Strategy”, ("Circular") has been drafted by the Presidency of Digital Transformation Office and the Ministry of Industry and Technology has been published in the Official Gazette dated 20.08.2021 and numbered 31574.

It was decided to amend the Decision on Taking Regulatory Measures on Some Issues Regarding User Rights in the Postal Sector, dated 23.09.2019 and numbered 2019/DK-SRD/206, via the Decision of the Information Technologies and Communication Board (“Board”), dated 03.08.2021 and numbered 2021/DK-SRD/212.

“The Regulation on the Reconciliation Procedure Applicable in Investigations Regarding Anti-Competitive Agreements, Harmonious Act and Decisions, and Abuse of Dominance” (“Regulation”) has been published by the Competition Authority (“Authority”) in the Official Gazette dated 15.07.2021 and numbered 31542. The Regulation regulates pursuant to Article 43 of the Law No 4054 on the Protection of Competition (“Law”); the procedures and principles regarding the process to be applied for the reconciliation for those who accept the existence and scope of the violation among the undertakings, or the associations of undertakings; about which an investigation has initiated regarding the prohibited actions in the Articles 4 and 6 of the Law. The regulation had entered into force in date of its publication. The procedures and principles regulated by the Regulation are as followings:

The “Communiqué on the International Bank Account Number” (“Communiqué”) has been published by the Central Bank of the Republic of Turkey in the Official Gazette dated 05.08.2021 and numbered 31559. Within the scope of the Communiqué, the amendments have been made to the Communiqué on International Bank Account Number (Number: 2008/6) published in the Official Gazette dated 10/10/2008 and numbered 27020. The purpose of this Communiqué is to determine the principles and procedures regarding the application of the international bank account number by the payment service providers:

“The Regulation on the Applicant’s Identity Verification Process in the Electronic Communications Sector” (“Regulation”) has been published by the Information Technology and Communication Agency in the Official Gazette dated 26.06.2021 and numbered 31523. The Regulation regulates the procedures and principles regarding the process to be applied for the verification of the applicant’s identity in case of electronic documentation of the following issues: subscription contract, GSM number porting application, qualified electronic certificate application,

Personal Data Protection Board (“Board”) rendered a decision dated 06.05.2021 and numbered 2021/470 (“Decision”) regarding the unredeemed access request of a data subject working in a data controller company (“Data Subject”) to the employer Data Controller (“Data Controller”), for the access to personal data regarding meal card account activities. Pursuant to the Decision, the Data Subject requested from the Data Controller to be forwarded the account movements of the meal card allocated to him/her by the Data Controller. In order to provide the requested information to the Data Subject, the Data Controller has requested certain information to verify the identity of the Data Subject.

Within the framework of the announcement (“Announcement”) published on the website of the Personal Data Protection Authority (“Authority”) on 25.06.2021, it is stated that there were hesitations in the opinion requests delivered to the Authority, about the registration obligations of business partnerships, consortia and ordinary partnerships in the Data Controllers’ Registry (“Registry”).

The Personal Data Protection Board Decision No. 2021/571 and dated 09/06/2021 on the Obligation to Register Economic Enterprises Belonging to the Data Controllers Registry of Foundations, Associations and Trade-Unions has been published in the Official Gazette dated 24 June 2021. Pursuant to the Decision of the Personal Data Protection Board (“Board”) dated 22/04/2020 and numbered 2020/315 and the amended Decision dated 02/04/2018 and numbered 2018/32, it has been provided exception to “associations, foundations and trade-unions established in Turkey that process personal data only in accordance with the relevant legislation and purposes, limited to their fields of activity”.

The Personal Data Protection Board (“Board”) rendered a decision dated 20.04.2021 and numbered 2021/407 (“Decision”) regarding the data breach notice of a data controller hospital (“Data Controller”). In the Decision, within the scope of the data breach notice submitted by the Data Controller, it was stated that (i) the breach was carried out with the instruction of the physician working in the hospital, by removing the files of the patients out of the hospital by the hospital staff; (ii) the employee who attempted to extract the file was detected 17 days after it was videotaped; (iii) all but one of the employees involved in the breach was given a training on protection of personal data prior to occurrence of the data breach; (iv) the Personal Data Protection Authority (“Authority”) was notified to the Board 25 days after the breach occurred, due to the reasons included in the breach notification regarding late notification.