Duyurular

Turkish Data Protection Authority Publishes the 2022 Annual Report

The Turkish Personal Data Protection Authority ("PDPA/Authority") published its 2022 Annual Report ("Report") on its official website.

 

The activities carried out by the Authority are analyzed under four headings and these headings are as follows;

  • Legal Activities
  • Review Activities
  • Data Management Activities
  • Corporate Promotion, Awareness, and Sensitization Activities

 

  • Legal Activities :
  • In 2022, within the scope of subparagraph (c) of the fourth paragraph of Article 25 of Law No. 6698 on the Protection of Personal Data ("Law"), a total of 232 legal opinion requests from within and outside the Agency were responded to. In addition, 38 opinions were given to draft legislation prepared by public institutions and organizations.
  • In relation to the Authority's field of duty and legislation, 168 opinion requests requested by public institutions and organizations and real and other private legal entities regarding the implementation of the Law were answered.
  • The total number of lawsuits pursued by KVKK is 562.
  • Of the 75 undertakings submitted for data transfer abroad, 45 were finalized; 5 of them were permitted, while 40 were rejected. The examination of 30 of them is ongoing.

 

  • Review Activities
  • Within the scope of Article 14 of the Law, during the period 01.01.2022-31.12.2022, a total of 9,059 notices and complaints were received by the Agency, of which 1,181 were received by mail, 1,372 through the e-complaint module and 6,506 through CIMER. The proportional distribution of these petitions is 72% via CIMER, 15% via the e-complaint module, and 13% via mail.
  • The sectors where the petitions received by the institution are intense: 48% services, 14% public, 13% telecommunications, 11% media, 4% each human resources and banking and finance, 2% each health and insurance, and 1% each tourism and IT.
  • Of the applications; 45.68% of the applications were about "unlawful processing of personal data", 19.31% were about "unauthorized SMS/calling", 17.05% were about "unlawful sharing of personal data", 10.56% about "failure to fulfill the requests of the data subjects", 4.93% about "violation of deletion, destruction and anonymization" and 1% each about "right to be forgotten", "not transferring personal data abroad" and "failure to fulfill the obligation to inform".
  • In 2022, 5,385 of the notices and complaints received by the Agency (67% of total notices and complaints) were rejected on the grounds that they did not meet the procedural requirements.
  • Between 01.01.2022 and 31.12.2022, a total of 10,370 petitions were examined, 9,059 of which were from the relevant period and 1,311 of which were from previous years. Of these petitions, 8,481 have been finalized and evaluations regarding 1,889 petitions are ongoing as of the end of the year.
  • A total of 48 Board meetings were held between 01.01.2022-31.12.2022 and a total of 1,415 decisions were taken by the Board as a result of these meetings. Eleven of these Board decisions were published in summary form on the official website of the Agency and presented to the public.

 

  • Data Management Activities
  • As of 31.12.2022, the number of registrations and applications to VERBIS is 208,500, the number of approved applications is 174,458, the number of rejected applications is 7,211, and the number of assigned contact persons is 197,101.
  • During the year, a total of 268 data controllers have imposed an administrative fine of TRY 85,483,000, 134 of which were imposed through notifications and complaints (TRY 20,738,000), 98 through data breach notifications (TRY 34,955,000) and 36 through VERBIS (TRY 29,790,000). It is understood that the main reason for the more than doubling of the fines compared to the previous year is VERBIS fines.

 

The full text of the Report in Turkish is available here.

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr