Turkish citizens living abroad have applied to the Personal Data Protection Authority ("Authority") regarding whether their financial account data has been transferred abroad. Although the citizens requested information from the banks where their accounts are located and the Turkish Revenue Administration within the scope of the Law, it was deemed necessary to investigate in accordance with the Personal Data Protection Law ("Law"). The Authority evaluated the applications made as follows:
According to paragraph 5 of Article 9 of the Law, without prejudice to the provisions of international agreements, personal data may be transferred abroad with the permission of the Personal Data Protection Board (“Board”) by obtaining the opinion of the relevant public institution in cases where the interests of Turkey or the person concerned would be seriously damaged. In addition, in paragraph 6 of Article 9 of the Law, it was noted by the Authority at the first stage of the assessment that the provisions of other laws regarding the transfer of personal data abroad are reserved.
In the case of international agreements, the Authority emphasized that personal data can be transferred abroad without seeking the explicit consent of the individuals or without being subject to the permission of the Board within the framework of these agreements, and stated that international agreements put into force according to Article 90 of the Turkish Constitution have the force of law. Regarding the transfer of financial account data abroad, the Authority stated that financial account
data can be transferred abroad in accordance with the "Multilateral Competent Authority Agreement on Automatic Exchange of Financial Account Information" (“Agreement”) to which Turkey is a party and published in the Official Gazette No. 30995.
The Authority has assessed that data transfers to be made abroad within the framework of the Agreement will not constitute a violation within the scope of Article 9 of the Law. In addition, in cases where personal data processing is necessary for the protection of the economic and financial interests of the state, the Authority has stated that Article 10 regulating the obligation to inform pursuant to subparagraph ç of paragraph 2 of Article 28 of the Law and Article 11 regulating the rights of the data subject, except for the right to claim compensation for the damage, will not apply.
As a result, it is concluded that the data transfers to be made abroad within the scope of the Agreement comply with the law pursuant to paragraphs 5 and 6 of Article 9 of the Law, and no violation of law has been detected within the scope of Law. From this point of view, the Authority has clearly announced that the complaints of the aforementioned nature, which have been received so far and will be received in the future, will not be evaluated.
You can reach the full text of the Authority’s evaluation from this link .