11 October 2019
The decision of the Personal Data Protection Board (the “Board”) dated 23/07/2019 and numbered 2019/225 concerning “The Request for Opinion on the Obligation of Foreign Legal Persons to Register Their Branches and Liaison Offices in Turkey with the Registry” (the “Decision“) sets forth the principles regarding the obligation of foreign legal persons and their branches and liaison offices in Turkey to be registered with the Data Controllers’ Registry Information System (“VERBIS”).
Decision evaluates the relevant obligation for foreign legal persons, their branches and liaison offices in Turkey, respectively. You may find below brief information on the Decision and the actions to be taken in accordance therewith.
As is known, real and legal persons who are responsible for the establishment and management of the data recording system and who determine the purposes and means of processing personal data (“Data Controller”) are obliged to be registered with VERBIS in accordance with the Protection of Personal Data Law No. 6698 (“PDPL”).
Accordingly, it has been decided that Data Controllers who are processing personal data directly or through their branches (in cases where branches do not determine the purposes and means of processing personal data at their sole discretion) in Turkey must be registered with VERBIS.
As a result, in cases where global HR processes exist, the databases of subsidiaries based in Turkey are kept abroad and the processes are carried out in an integrated manner with global companies, the foreign entity to which the data is transferred must also be registered with VERBIS. Furthermore, Data Controllers may transfer the personal data of data subjects to the safe countries that will be announced by the Board without explicit consents of data subjects. As the Board has not announced the list of safe countries yet, currently, a data transfer agreement must be signed between the Turkish company and the company to which the data is transferred, and the agreement must be submitted to the Board for its approval.
According to PDPL, only the real or legal persons may qualify as a data Controller. However, the Board has decided that branches who act in Turkey independently from their parent companies and in a manner falling in the scope of the criteria determining the Data Controller, must be deemed as Data Controllers, considering the facts that the branches of legal persons residing abroad are registered with the Trade Registry in accordance with Article 40 of the Turkish Commercial Code (although they do not have a separate legal personality) and having a legal personality is not among the criteria stipulated under Article 4 of the GDPR.
Accordingly, it has been decided that if Turkey-based branches of legal persons residing abroad are responsible for determining the purposes and means of processing personal data in accordance with the definition of Data Controller under PDPL and for establishing and managing the data recording system, they will be considered as a Data Controller beside the legal person residing abroad, and the obligation of the relevant branches to be registered with VERBIS will be evaluated by taking into account the criteria of “annual number of employees” and “annual financial balance” set forth under the Board's decisions no. 2018/88 and no. 2019/265, and branches who do not fall in the scope of these evaluations will not be obliged to be registered with VERBIS.
The Decision states that in order to be able to open a liaison office in Turkey, the parent company must be incorporated abroad in accordance with the laws of the relevant jurisdiction, and that the liaison offices established in Turkey cannot engage in any commercial activities and must only aim providing services on matters other than commercial activities and informing the parent company on such matters. It is concluded that considering that the liaison offices do not qualify as a branch and act in accordance with the instructions of the parent company abroad, liaison offices are not obliged to be registered with VERBIS.
In our opinion, the Board's decision that the companies residing abroad must be registered with VERBIS if the relevant conditions exist, and the Turkey-based liaison offices of the companies residing abroad are not required to be registered with VERBIS, supports the prevailing opinion among the practitioners. The Decision on the liability of Turkey-based branches of foreign companies to be registered with VERBIS and whether they qualify as Data Controllers helped to solve the disagreements among the practitioners and clarified this issue.