Lawyer Erdem Arda Akay
»With the Decision dated 23.07.2019 and numbered 2019/225 issued by the Personal Data Protection Board, located directly abroad or companies with branches in Turkey should be noted the Registry Records; on the other hand, liaison offices which don’t do any commercial activities in Turkey but only working for the purposes of communication, promotion, advertisement and providing information to the company, don’t have an obligation to register the data controllers registry.
Decision Summary
The Personal Data Protection Board’s decision upon request of their opinion;
“a) Directly or through branches in Turkey and abroad in the personal data processing activities of the resident company responsible for the data registers must be registered
b) Branches of legal entities residing abroad of branches in Turkey, setting by definition responsible for the data contained in the law of personal data processing objectives and means and the establishment of a data recording system if responsible for managing the separate legal entity located abroad resident data as responsible in Turkey will be evaluated. In this case, in terms of legal entities, the Personal Data Protection Board 2018/88 dated and 2019/265 dated Situated in the decision for branches in Turkey, “the annual number of employees” and “annual financial balance sheet total” criteria for the evaluation to be made in terms of presence Registry registration obligation that will be decided. Branches that are not in this situation have no obligation to register in the Registry.
c) For open liaison offices in Turkey for companies residing abroad, they should be established according to the laws of the foreign legal entity. These offices cannot make any commercial activities. These are the offices that are opened for the purpose of communication, feasibility research, conducting some studies in social and cultural areas, making preparations for mergers and transfers between companies, promotion and advertising, closely following the job opportunities in the country and informing the central firm about these issues. These liaison offices don’t have an obligation to register in the Registry, because of they don’t have any characteristics about branches.”
The Concept of Data Controllers in the Light of Decision
»In Article 16 of the Law on the Protection of Personal Data No.6698, a regulation has been made that natural and legal persons who process personal data are obliged to register with the Data Controllers Registry before starting data processing. It has been stated that an exception can only be made by the Board, taking into account objective criteria to be determined by the Board, such as the nature and number of personal data processed under this obligation, the data processing originating from the law or the status of their transfer to third parties.
»In order to evaluate the decision made by the Board, it would be useful to first consider the concept of “data controller” within the scope of the legislation. In the definitions section of the Personal Data Protection Law, which entered into force on April 7, 2016, the data controller is explained as “the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system”. Accordingly, in order to mention a data controller, it is necessary to have a natural or legal personality first. In addition, the natural or legal person responsible for the data; It has to be able to make savings as a decision-maker in important matters such as for what purpose and in what way these data processed during the personal data processing process will be processed, how the data obtained from the relevant persons will be integrated into a recording system and how the data processing process will be controlled, and how long the processed data will be stored.
Conclusion
»The decision made by the Personal Data Protection Board explained who will be considered as the data controller and in this context, who has the obligation to register in the data registry. Due to the investments originating from abroad and because the service sector in the world crosses the national borders, foreign legal entities residing abroad operate in our country by opening branches or establishing liaison offices. These activities bring along some personal data processing operations, and it comes to mind whether they are data controllers for the data processing branch or liaison office. No question marks were left in minds with the clear decision of the Board on this matter. Branches in Turkey of legal entities which located abroad, will be conferred to an independent data controller for the capacity of legal persons if they are responsible for managing with the aim of processing of personal data in their own systems and the establishment of determining the tools and data recording system. As the most important result of the said branches being accepted as data controller, it will be decided as a result of the evaluation to be made in terms of “annual number of employees” and “annual financial balance sheet total” criteria. On the other hand, liaision offices only make activities about promotion, advertising and don’t have an obligation to register in the Registry, because of they don’t have any characteristics about branches.