The Turkish Data Protection Authority’s Decision on Black List Practices in the Car Rental Industry

After the investigations carried out within the framework of Article 15 of the Personal Data Protection Law (“Law”), the Personal Data Protection Board (“Board”) has been published "Principle Decision" that is about the “black list” software/programs/applications applied in the car rental sector in the Official Gazette dated 20 January 2022 and numbered 31725.

As a result of the investigation;

• In case personal data is processed in black list applications in the car rental sector, in violation of the data processing conditions and data transfer provisions regulated in Articles 4, 5, and 8 of the Law; car rental companies and software companies that have control over the data will be considered as "joint data controllers".
• Unlawful practices will be terminated. Necessary technical and administrative measures, regulated in Article 12 of the Law, will be taken by the data controllers to ensure that personal data processing processes in the car rental sector comply with the Law.
• Action will be taken against the data controllers who do not take the precautions and apply to the black list application in violation of the provisions of the Law in the car rental sector, under the provisions of Article 18 of the Law.

You can reach the full text of the decision here.

 

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr