The Personal Data Protection Authority ("Authority") published on its website on 01.09.2023 that the Personal Data Protection Board ("Board") has accepted the commitment application of Google Advertising and Marketing Limited Company for the transfer of personal data abroad.

Since 2021, the Board had granted permission for the transfer of personal data to the data controllers listed below:

• TEB Arval Vehicle Fleet Leasing Inc.
• Amazon Turkey Retail Services Ltd. and Amazon Turkey Management Support Services Ltd.
• Turksport Sports Products Industry Trade and Limited Company (Decathlon Turkey)
• Turkish Football Federation
• Otokoç Automotive Trading and Industry Inc.

In this context, the latest data controller company that applied for a commitment and obtained permission for data transfer is Google Advertising and Marketing Limited Company.
However, it should be noted that within the scope of this commitment application, Google Advertising and Marketing Company can only transfer personal data to the relevant data controller located abroad, and there is no data transfer permission granted for other companies affiliated with Google.

How to Make a Commitment Application?

In accordance with Article 9 of the Law No. 6698 on the Protection of Personal Data ("KVKK") regarding the transfer of personal data abroad, personal data cannot be transferred abroad without the explicit consent of the data subject. However, when data controllers in Turkey and the relevant foreign country provide written assurance of adequate protection and the approval of the Authority obtained for this commitment, the data can be transferred abroad without the explicit consent of the data subject.

Commitment applications can be prepared for both transfers from the data controller to the data controller and from the data controller to the data processor. However, the parties must use the suitable commitment template published on the official website of the Authority. Additionally, there are certain points to be considered in terms of both procedure and substance when making a commitment application. Furthermore, during the transfer, information about the data subject groups, data categories, purposes of the transfer, legal basis for the transfer, recipients and recipient groups, technical and administrative measures to be taken by the data recipient, additional measures taken for special categories of personal data, and contact information of the data controller and contact person must be provided to the Authority.

Why Should a Commitment Application Be Made?

Data controllers, both natural and legal persons, are required to evaluate their operations in accordance with the KVKK and transfer personal data in a manner compliant with the law. According to the KVKK, personal data can be transferred in three ways:

1.    Obtaining explicit consent from the data subject.
2.    The country to which the personal data will be transferred is one of the countries that provide adequate protection, and one of the processing conditions for personal data or special categories of personal data exists.
3.    If there is no adequate protection in the country where the personal data will be transferred, the data controllers in Turkey and the relevant foreign country must provide written assurance of adequate protection, and the approval of the Board for this transfer must be obtained.

Since Turkey has not yet determined a list of countries with adequate protection, data controllers are left with the options of obtaining explicit consent from the data subject and making a commitment application.
Making a commitment application also helps to alleviate the burden on data controllers regarding the transfer of personal data to a data controller abroad. With the permission granted through the commitment, personal data can be transferred abroad without obtaining explicit consent, based on the processing conditions for personal data and special categories of personal data. The biggest advantage provided by the commitment is seen in the context of carrying out operations.
For example, in the context of the personal data transfer activities of companies, it is no longer necessary to obtain explicit consent from thousands of data subjects. In addition, the transfer of personal data abroad within the framework of the commitment can be carried out more quickly and systematically.

Under the KVKK, data controllers can make commitment applications for the transfer of personal data abroad. With the commitment, the parties can transfer personal data abroad without obtaining explicit consent, based on the existence of the processing conditions for personal data. As of 01.09.2023, within the scope of the announcement published on the website of the Authority, Google Advertising and Marketing Company is now a party to the commitment and can transfer personal data to the data controller/data processor located abroad based on the processing conditions for personal data specified in the commitment. The transfer without obtaining explicit consent is also of great importance for alleviating the operational burden of the company.