A new law has been published that concerns advanced payment systems such as PayPal, which has not been used in Turkey for a long time, Apple Pay, the NFC-based payment service on the iPhone, and foreign-based companies such as X, Facebook and Instagram. Accordingly, all obstacles for PayPal and Apple Pay may have been eliminated.
PayPal and Apple Pay are now open! New law published
An important change was made in Article 9 of KVKK No. 6698, which was included in the Official Gazette decisions published last night. Accordingly, global companies established abroad, such as Meta, X, PayPal, Apple Pay, etc. They will be able to host the personal data of their users in their own country. However, he will be expected to meet the qualifications to do this.
PayPal, one of the most common payment systems in the world, and Apple Pay, one of the contactless payment methods, were not found suitable by the BRSA, and they did not want to keep any of their personal data in Turkey.
Summary of Amendments to Article 9 of the Personal Data Protection Law No. 6698
Qualification Decision:
- If the Board makes an adequacy decision for the country, sector or international organization to which personal data will be transferred, the data controller and data processors may transfer data to this country.
- The qualification decision is reviewed every 4 years and may be changed, suspended or removed when deemed necessary.
- The criteria to be taken into account when making the qualification decision are as follows:
- reciprocity status
- Personal data protection legislation and practice
- Existence of an independent and effective data protection authority
- Being a party to international agreements
- Membership in global or regional organizations
Lack of Qualification Decision:
- If there is no adequacy decision, data transfer can be made if one of the following appropriate safeguards is provided:
- Agreement and Board permission that do not constitute an international contract
- Binding company rules and Board approval
- Standard contract announced by the Board
- Written undertaking and Board permission to provide adequate protection
Incidental Transfer Situations:
- If there is no adequacy decision and appropriate safeguards, incidental data transfer may occur in the following cases:
- Explicit consent of the person concerned
- Obligation for the performance of the contract or for measures prior to it
- Obligation for the establishment or execution of a contract for the benefit of a person
- superior public interest
- Obligation to protect a right
- emergencies
- Transfer from public registry
- These cases do not apply to the activities of public institutions subject to public law.
Next Transfer and International Organizations:
- Subsequent transfer of personal data transferred abroad and transfer to international organizations are also considered within the scope of this law.
Other Considerations:
- In cases where the interests of Turkey or the relevant person will be seriously harmed, data transfer may be made with the permission of the Board.
- The provisions of other laws regarding the transfer of personal data abroad are reserved.
- The procedures and principles regarding the implementation of this article are regulated by the regulation.
All decisions regarding the bill in question from here you can read.