The Personal Data Protection Authority (“Authority“) published a decision regarding the transfer of personal data abroad on 26 October 2020.
The Authority, which is expected to clarify the issue of personal data transferring abroad that causes various discussions for a while, expresses that it aims to establish a transparent data transfer regime by addressing the issue on the basis of protecting fundamental rights and freedoms of data subjects without making it difficult for data controllers to transfer personal data abroad.
In the announcement;
- The Authority expressed that the transfer of data abroad is also considered as a data processing activity and that is regulated under a separate provision in order to aimed to ensure that the personal data of data subjects may also be effectively protected in the country where it is transferred. Therefore, it is emphasized that adequate protection is required in the country where personal data is transferred.
- The Board emphasized that they are currently working on a list of countries with adequate protections. The Board also added that such determination is a dynamic and lengthy process, which include the establishment of cooperation and communication mechanisms within a country, requiring comprehensive and multidimensional assessments.
- It was emphasized that the Protection of Individuals Against Automatic Processing of Personal Data No 108 does not constitute an obstacle to the provision of a prohibition or a restriction by a special authorization mechanism under domestic law
