PDPA Published a Guidelines on Cookies
Before moving on to the guide, we would like to first mention some of the basic information;
GDPR (General Data Protection Regulation) is a regulation created across Europe to protect the personal data of European Union citizens.
Personal data means any information relating to an identified or identifiable natural person (data subject).
(In general, even if a company is not located within the borders of the European Union, if the data of citizens residing within the European Union is collected, that company will be held responsible for GDPR. Providers of goods or services with a customer base within the European Union are required to process data in accordance with the GDPR.)
No personal data can be processed unless as specified in the regulation or if a clear consent is obtained from the person concerned, namely the personal data owner. The consent of the personal data owner must be obtained, the conditions specified in the law or the statute must be fulfilled or express consent should be obtained.
The sanctions determined for non-compliance with GDPR, is a fine of up to EUR 20,000,000 or up to 4% of the previous year's financial global turnover; (whichever is higher).
GDPR and KVKK(*) (Personal Data Protection Law) Comparison
The purpose of the KVKK is to impose certain obligations to prevent illegal processing of personal data, and to protect the most fundamental rights and freedoms, in general.
Turkey's Personal Data Protection Law (KVKK) No. 6698 entered into force on 7 April 2016, just a few weeks before the EU's GDPR approval.
One of the most important differences relates to liability for violations.
It also imposes a responsibility on the data responsible, the data controller and the data processor, namely the legal entity, which is classified as a data processor, as well as on the legal entity whose counterpart is the data controller within the scope of the KVKK, which is called the data controller in GDPR.
Some concepts included in GDPR but not in KVKK are as follows;
Data Protection Officer
Data Protection Representative
Data Protection Impact Assessment It is an assessment of the impact of the processing activities of the data controller prior to the processing on the protection of personal data. GDPR requires assessments to be made in case of extensive processing of personal data.
There is an obligation to register in the KVKK. It is mandatory to use VERBIS (personal data protection law compliance process).
There is a clarification text in KVKK and GDPR. Accordingly, in case of processing a personal data; there is an obligation to inform the person concerned regarding the reason and the purpose of processing; the place(s) the personal data will be processed; the duration and the legal basis of processing.
[(*) KVKK is the Turkish acronym for Personal Data Protection Law]
GDPR- Cookies
It is one of the strongest data protection laws around the world. It defines and determines which data can be collected / processed; how should they be stored; how to use that information; what Privacy Policies must exist and the content of the consent necessary.
Under the GDPR, consumers can control, the collector’s information about them, what information is gathered, how this information is used, whether any third parties get access to this information.
As in Turkey, consent can be withdrawn.
The privacy policy tells users how their personal data will be collected and used.
To create a legally effective Cookie Policy, the document must include certain terms. It must include explanation on:
- How you use the cookies
- The types of cookies used on the site
- If information is transferred to or used by third parties
- How users can reject cookies, and how to turn them off
The highlights of the guide on cookies published by the Personal Data Protection Board:
- The "general cookie term and cookie types", which includes the same types as GDPR, are explained.
- Since the main rule in the law is "explicit consent", the principles and exceptions of the use of cookies are mentioned.
- A distinction is made between Criterion A (the use of the cookie only for the purpose of providing communication over the electronic communication network) and Criterion B (the absolute necessity of using the cookie).
- It has listed the elements of explicit consent that should be obtained in the same way as GDPR.
- The main information about the transfer of data abroad, which is not very detailed, is given.
- Details of legal clarification text are given.
- There is an evaluation of the decision of the Personal Data Protection Board dated 27/02/2020 and numbered 2020/173.
Although GDPR and KVKK deal with more or less the same topics under similar headings, we see that each item is explained in more detail in GDPR and the system is made a little more specific.
The content herein is aimed at providing a general insight regarding the subject. For customized circumstances or for further information, please refer to your lawyer.