Turkey: KVKK issues statement on obligation to inform
The Personal Data Protection Authority ('KVKK') issued, on 26 June 2020, a statement on data controllers' obligation to inform. In particular, the KVKK highlighted data controllers' obligation to inform under the Law on Protection of Personal Data No. 6698 ('the Law'), secondary legislation regarding the Law and decisions made by the KVKK, and noted that it had received a number of complaints on the same. Specifically, the KVKK noted that these complaints included data controllers not meeting the requirements of the obligation to inform, such as the absence of clear, plain language and information on the transfer of data being insufficiently explained.
Moreover, the KVKK noted that these common errors are violations of the Law and that in order to avoid penalties, data controllers should note, among other things, that proof of the obligation to inform has been fulfilled and lies with the data controller, as well as using clear and plain language. In addition, the KVKK highlighted that as a minimum, Article 10 of the Law requires the disclosure of the identity of the controller and, if any, his/her representative, the purposes of processing of personal data, the persons and purposes for which the data processed can be transferred, and the means and legal basis for collection of personal data, as well as information on the other rights of the data subject under Article 11 of the Law.
You can read the press release, only available in Turkish, here.