On January 4, 2020, an amendment to the Regulation on Commercial Communication and Commercial Electronic Messages (“the Regulation”) was made by the Turkish Ministry of Trade (the “Ministry”), and a central database named Commercial Electronic Message Management System (“IYS”) was introduced. The following paragraphs illustrate a brief understanding on the operation and purpose of the system, as well as discussing its defects and how they are related to the data protection law.

What is IYS?

IYS mainly targets the management of commercial electronic messages to prevent spam emails, SMS and phone calls due to the increase in user complaints. The system is designed to store all consent records (opt-in records) of subscribers/users that can be reviewed and monitored by the government and subscribers/users via the system. As per the Regulation, the Companies that wish to send electronic communications in all sectors are required to transfer their consent records to IYS.

What are the Requirements and Deadlines?

Other than the exempted types of communications, the companies must transfer the records of consents (opt-in records that consists of contact information of the users/subscribers) for sending commercial electronic messages that were previously obtained to IYS until December 1, 2020. If the companies fail to transfer the consents to the IYS until the deadline, the consents will be deemed invalid.

On the other hand, companies are also required to register to IYS until January 16, 2021, to send business to business marketing communications. Therefore, all legal entities and natural entities are expected to register to IYS in the given dates if they wish to send commercial electronic messages, regardless of the context of the communication. It is important to note that the Ministry is entitled to postpone the deadlines up to six months through considering the concerns of the service providers. Hence, in any case preparation to the system is mandatorily required and companies must also transfer the consent records and opt-out information that will be obtained after January 16, 2021 to the IYS.

What are the sector’s concerns related to the IYS?

IYS is considered as a controversial issue since the Ministry asked the Union of Chambers and Commodity Exchanges (“TOBB”) to incorporate the system but instead TOBB incorporated a private entity to manage the IYS on behalf of itself. On the other hand, no official document regarding such authorization made by the Ministry or TOBB is publicly announced in this respect. This became a problem as it might be risky for the companies to transfer consent records, which contain an important amount of personal data of subscribers/users by nature, to a private entity.

On the other hand, there are certain concerns due to the operation of the system and its compliance with the requirements stipulated under Turkish Data Protection Law numbered 6698 (“Turkish DPL”) since IYS’ compliance with the Turkish DPL is also vague in various areas. IYS is not transparent in sharing technical and administrative measures with the data providers in terms of storing personal data, which is outlined as a requirement to be fulfilled by the Turkish DPL. In addition, IYS requires clarification for the privacy of the transferred data, especially for the matters of not using the data for other commercial purposes or sharing them with third parties. Considering such ambiguities occurred in IYS, companies are concerned that they might be deemed to have violated a legislation while fulfilling their obligations arising from another legislation, which may cause penalties such as administrative fines.

Besides, IYS is also criticized by the companies with a competition law perspective. As per the Regulation, IYS will be able to collect the CRM data of companies and can offer paid CRM services to the companies. Since IYS will act as a public monopoly, this will automatically affect the market share of other private CRM companies and IYS can also define the pricing of its services by itself and there is a concern that it can be easily able to undercut the private CRM companies’ pricing.

As a result of the mentioned concerns, there are several administrative lawsuits initiated with the request of annulment of the amendments to the Regulation, regarding institution of IYS. Additionally, the claimants requested the court to issue a suspension of Regulation’s execution as an interim injunction, related to which the court has not issue its order yet.

Are there any alternative model to IYS offered by companies to the Ministry?

Based on the proceedings against the application of the Regulation, alternative models have become subjects of discussions. The model known in Europe as the “Robinson Lists” is presented to the Ministry for the consideration of making a replacement with the current system. Through the application of Robinson Lists, recipients can explicitly use their rights to opt-out by registering to the lists. On the other hand, service providers are obliged to check which recipients are on these lists and to avoid sending commercial electronic messages to the ones that are registered. In addition, service providers are expected to update their database of communication lists so that they comply with the Robinson Lists.

As a result of the application of the lists, the risk of transferring personal data to a single database (namely to the IYS) is eliminated by authorizing companies to establish their own management mechanisms. In this way, principles of confidentiality will be protected by preventing the transfer of the collected data to a database, when the opt-out rights of the people will still be respected. In addition, the activities required by the service provider companies to comply with the system will be greatly reduced.

Conclusion

In Turkey, all sectors are closely monitoring any development on the IYS.  It is wondered whether the Ministry will extend the deadlines or make any amendments on the system.

For more information on IYS and its operation, please do not hesitate to contact us.