The Personal Data Protection Law was adopted by the Grand National Assembly of Turkey (TBMM) on 24/03/2016 and entered into force upon its publication in the Official Gazette No. 29677 dated 07/04/2016. It was enacted both to protect individuals' rights in the processing (use) of personal data and to set out the rules that data controllers must follow.
In Turkey, various public and private institutions used to process personal data without the individual's knowledge. This led both to improper use of customer information and to customer dissatisfaction. The Personal Data Protection Law, prepared to remedy this gap, is designed to protect the rights of the data subject. For example, institutions that process personal data must, at the data subject's request, explain which information they process, for how long, and for what purpose. The data subject may also request that inaccurate data be deleted or corrected. The operation of this system is supervised by the Personal Data Protection Board to be established. In the event of disputes, this Board also protects the rights of the data subject by imposing various sanctions on the data controller.
Card issuance and related obligations
ARTICLE 8 - Card issuers may not issue cards in any form or manner in the name of persons who have not requested a card or signed an agreement. Apart from the head office or branches, the places where credit card applications may be collected on behalf of these institutions are determined jointly by the Banks Association of Turkey and the Participation Banks Association of Turkey, with the approval of the Institution.
So what is the effect of the law on payment systems? Which articles of the law relate to payment systems?
Retention of information
ARTICLE 23 - Merchants may not disclose, retain or copy information about the card and the cardholder that they obtain as a result of card use without obtaining the cardholder's written consent, except for persons, institutions and organizations authorized by law. Merchants may not share, sell, purchase or exchange card information with persons or institutions other than the institution with which they have a merchant agreement. Institutions that enter into merchant agreements are obliged to oversee the application of this paragraph.
Card issuers are obliged to keep the personal information they obtain confidential, not to use it for purposes other than marketing their own services, and to take the necessary measures to prevent anyone other than persons, institutions and organizations authorized by law from accessing this information.
Confidentiality of secrets
ARTICLE 31 - Board members and Institution personnel may not disclose to anyone other than those expressly authorized by law, nor use for their own benefit, any secrets belonging to the institutions, cardholders and guarantors within the scope of this Law that they learn in the course of their duties.
Institutions that establish card systems, issue cards or enter into merchant agreements, the institutions referred to in Article 29, and merchants, together with their partners, board members, personnel, persons acting on their behalf and officers, may not disclose secrets they learn by virtue of their status and duties to anyone other than the authorities expressly authorized by law. This provision also applies to the institutions from which card issuers receive support services and to their employees.
Violation of the information security obligation
ARTICLE 39 - Institutions, merchants, and the officers who actually manage the affairs of institutions that enter into merchant agreements, as well as the persons who carry out the transaction, who knowingly act in violation of the fifth paragraph of Article 8 and of Article 23 of this Law shall be punished with imprisonment from one to three years and a judicial fine of up to one thousand days.
Card issuers, merchants, and the officers and relevant personnel who actually manage the affairs of institutions that enter into merchant agreements, who cause the disclosure of the code number, card number, password or any other identifying method that is required for card use and must be kept secret, through carelessness, negligence, professional incompetence, or violation of orders and rules, shall be punished with a judicial fine of up to one thousand days.
Those who act in violation of Article 31 of this Law shall be punished with imprisonment from one to three years and a judicial fine of up to one thousand days.
