THE TURKISH DATA PROTECTION AUTHORITY FINES TWO COMPANIES 680.000₺ IN TOTAL

7 October 2019

The Turkish Data Protection Board (The “Board”) released two decisions on their web site on 4 October 2019 about the data breaches which took place in the “S Şans Inc.” and a tourism company (whose name was not declared to the public).

Firstly, S Şans Inc. submitted three notifications to the Board to explain the data breach. According to these notifications, S Şans Inc. operates on the website www.tuttur.com and on 14.09.2018 one of the members of the Company had reached out and stated that an Excel list containing the phone numbers of some users and the member numbers sent by the SMS company in case they lose their password are circulated on illegal web sites.

However, the date of the data breach and the number of persons affected could not be determined by the Company. The company was able to determine that only groups of people affected by the breach were company members / customers, and that the categories of personal data affected by the breach were users' first and last names and mobile phone numbers.

Based on these findings, the Board fined the Company 150,000 ₺ because of not taking the necessary technical and organisational measures, and 30,000 ₺ for not notifying the relevant people affected by the breach.

Secondly, the Board investigated a data breach at a tourism company. After the investigation, the Board stated the data breach was caused by a cyber attack which was captured relevant passwords to enter with unauthorized password through the Company's Local Area Network (LAN), and this incident was carried out by infiltrating the Company's network through an employee computer in public areas.  This breach affected the personal data of both personnel and the customers.

According to these findings, the Board fined the Company 400.000 ₺ for not taking necessary technical and organisational measures, and 100.000 ₺ for not notifying the relevant people and the Board as soon as possible.

You can find the texts of the decisions (in Turkish) here and here.

Should you have any queries and/or remarks, please do not hesitate to contact us. 

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr