Turkish Data Protection Authority Publishes Its Annual Report For 2023

Data Protection Law

The 2023 Annual Report (‘Report’) was published by the Turkish Data Protection Authority (‘Authority’) on its official website.

The Auhority’s activities are analysed under the following four headings;

1-Legal Activities

In 2023, within the scope of subparagraph (c) of the fourth paragraph of Article 25 of the Law No. 6698 on the Protection of Personal Data (‘Law’), a total of 146 legal opinion requests from within and outside the Authority were answered.
In relation to the field of duty and legislation of the Authority, 100 opinion requests requested by public institutions and organisations and real and other private law legal entities regarding the implementation of the Law were answered.
The Authority responded to 46 legal opinion requests received by other units of the Authority on legal issues of doubt.
The total number of lawsuits followed up by the Authority is 868.

2- Review Activities

Within the scope of Article 14 of the Law, during the period 01.01.2023-31.12.2023, a total of 9,396 notices and complaints were received by the Authority, of which 443 were received by mail, 1,372 through the e-complaint module and 7,581 through CIMER. The proportional distribution of these petitions is 81% via CIMER, 14% via e-complaint module and 5% via mail.
In the sectoral distribution of 9,396 petitions submitted to the Authority, the service sector has the highest share with 2,336 petitions, followed by telecommunications, media and public, banking and finance.
Of the applications; 53% of the applications were related to ‘unlawful processing of personal data’, 23% to ‘unauthorised SMS/calling’, 13% to ‘unlawful sharing of personal data’, 5% to ‘failure to fulfil the requests of the data subjects’, 3% to ‘violation of deletion, destruction and anonymisation’ and 1% each to ‘right to be forgotten’, ‘failure to fulfil the obligation to inform’ and ‘failure to transfer personal data abroad’.
In 2023, out of 9396 notifications and complaints received by the Authority, 5,468 (58% of total notifications and complaints) were rejected on the grounds that they did not meet the procedural requirements.

Between 01.01.2023-31.12.2023, a total of 11,285 petitions, 9,396 from the relevant period and 1,889 from previous years, were examined. Of these petitions, 9,711 have been finalised and evaluations regarding 1,574 petitions are ongoing as of the end of the year.

3-Data Management Activities

As of 31.12.2023, the number of registrations and applications to VERBIS is 226,201, the number of approved applications is 188,633, the number of rejected applications is 7,597, and the number of appointed contact persons is 213,065.
During the period 01.01.2023-31.12.2023, a total of 150,410,000 Turkish Liras administrative fines were imposed on domestic and foreign real and legal person data controllers who did not fulfil their registration and notification obligations to the Registry, and administrative sanctions were imposed on 11 public institutions and organisations.

4- Promotion, Awareness and Awareness-Raising Activities

In 2023, the Authority organised 13 Wednesday seminars, 8 workshops, 28 trainings, 2 summits, 7 meetings, 6 other events (congresses, symposiums, panels, etc.) and participated in 99 events.

You can access the full text of the Report (in Turkish) here.

Kind regards,

Zümbül Attorneys-at-Law

info@zumbul.av.tr