On 10 July 2023, the European Commission formally adopted the adequacy decision for the European Union ("EU") and the United States of America ("US") on the adequate level of protection for personal data transferred under the EU-US Data Privacy Framework (the "DPF"). Personal data transfers between the EU and the US therefore now rest on a fully fledged legal basis. The DPF is significant in that it recognises the US as a country meeting the adequate level of protection criteria laid down in the General Data Protection Regulation of the European Union (the "GDPR"). In short, the DPF builds a "data bridge" between the EU and the US.
Background
As early as 2000, the US and the EU concluded the Safe Harbor Agreement (the "Agreement"), which governed data transfers to and from the US. The Agreement was replaced in 2016 by the "EU-US Privacy Shield", which has now in turn been replaced by the DPF. The DPF is the only fully stable legal basis for data transfers between the EU and the US.
How the DPF Works
The DPF allows US organisations operating within the European Economic Area to transfer personal data from the EU, on condition that they are included in the "Data Privacy Framework List" and comply with the DPF principles on an ongoing basis. The US Department of Commerce is authorised to monitor whether listed organisations comply with the DPF principles and to take the measures needed to secure compliance. The DPF also sets limits on access by US intelligence services to personal data originating from the EU. US intelligence services may access such data for national security purposes only where existing legislation permits that access.
The DPF further contains several binding safeguards designed to address the concerns previously raised by the Court of Justice of the European Union. Among other things, it sets up an independent court, the Data Protection Review Court (the "Court"), to which EU citizens may apply for a judicial remedy. If the Court finds that data has been collected in breach of the safeguards, it may order that data to be deleted. The functioning of the DPF is subject to periodic review by the data protection authorities and other relevant authorities. If the US is considered to no longer be a safe country for data transfers, the European Commission may notify the relevant US authorities and restrict the scope of the DPF or even repeal it.
Relevance for Türkiye
The DPF has wide-ranging influence, including in jurisdictions that fall outside the scope of the GDPR, such as Türkiye. Under the Turkish Data Protection Law, the Turkish Data Protection Authority (the "Authority") is authorised to announce a list of safe countries. The Authority has not yet published such a list. It does, however, apply a set of criteria when assessing whether to approve data transfers outside Türkiye, and the DPF may therefore influence its assessment of requests for approval of transfers to the US.
Other Developments in Turkish Data Protection
- Cooperation between the Turkish Competition Authority and the Personal Data Protection Authority: On 26 October 2023, the Turkish Competition Authority announced that it had signed a Cooperation and Exchange of Information Protocol with the Personal Data Protection Authority. The protocol aims to address concerns regarding the use of big data technologies.
- Guideline on the processing of genetic data: On 13 October 2023, the Personal Data Protection Authority published its Guideline on Matters to be Considered in the Processing of Genetic Data. The Guideline stresses the importance of personal data security when genetic data is processed and gives guidance to data controllers. It also defines genetic data for the first time.
- Approval of an undertaking application for Google: By its decision dated 17 August 2023, announced on 1 September 2023, the Personal Data Protection Board approved the application of Google Turkey for the transfer of personal data outside Türkiye.