When Facebook's director of privacy and public policy and director of public policy visited Turkey in May 2019 for an IAPP KnowledgeNet event, it was right after the Personal Data Protection Board had fined the social networking company 1,650,000 TL because of an application programming interface error that allowed third parties to illegally access photos of Facebook users between September 13 and 28, 2018. After the event, the Facebook directors visited the board, probably hoping that it was the first and final fine they would pay in Turkey. Well, it was the first one for sure but definitely not the last as the data protection authority fined Facebook Turkey again, this time 1,600,00 TL (almost $290K USD) for failing to notify the DPA that a data breach had occurred and for not taking sufficient technical measures with regards to the breach.

The breach, which took place between July 21, 2017, and Sept. 28, 2019, resulted when hackers exploited a flaw in the company’s “View As” feature, which lets users see what their profiles look like from other accounts (i.e., to check that their privacy settings are working, etcetera). Facebook also provided the details of the breach in an Oct. 12, 2018, blog post.

Many privacy scholars and professionals, including myself, wondered why the amount of both fines differ when the board’s decision in both cases are almost the same. This is still a big question as the Turkish DPA has not yet delivered a metrics of “fining methodology” to explain their decisions.  

Experts on data governance know that the one who has the best and objective metrics is the best to calculate the risks. A metric is a unit of measurement that should be as objective as possible. They help directors or managers help answer questions, such as “How much fine are we expected to pay when some type of personal data of our customers are leaked?” or “What is the highest limit of fine are we expected to pay when a certain type data security flaw has occurred?”

Article 18 of the Turkish Personal Data Protection Act (KVKK) specifically defines the types of fines to be imposed under four paragraphs, and under each paragraph, the range of fines are listed. These are:

1. Failure to fulfill the obligation to inform (5,000 TL to 100,000 TL).
2. Failure to fulfill provisions for data security (15,000 to 1,000,000 TL).
3. Failure to fulfill decisions made by the board (25,000 to 1,000,000 TL).
4. Failure to fulfill data controller (VERBIS) registration and obligation to notify VERBIS updates (20,000 to 1,000,000 TL).

The fines are updated every year due to the revaluation of administrative fines. In 2020, the lowest fine is 9,000 TL, while the highest figure is TL 1,800,000.

The board has discretion in determining the fines for the establishment of administrative fines in the KVKK by specifying the lowest and highest limit. Such discretion, in conformity with the second paragraph of Article 17 of the Misdemeanors Act, shall be used by considering the unfair content of the misdemeanor and the perpetrator's flaw and its financial status. This approach is also emphasized in the "glossary" published by the board by giving an example that clearly states that in a sample scenario in which the administrative fine is concerned, a family company and a holding structure operating nationwide will be subject to a different number of fines. 

Unfortunately, this is the only concrete information that we have in the board’s publications and the wide range of the numbers defined in the Article 18 of KVKK, creates an unpredictable risk assessment issues for the data controllers in practice.

On the other hand, “considering the financial status of the controller” might mean that the board must also investigate the financial status of the data controller. In such a case, it is not clear whether any information or document about the financial status of the controller is requested when the board requests defense from companies that are not public. Therefore, it is not clear what metrics the board systematically uses when imposing administrative fines.

For example, Amazon Turkey recently faced a 100,000 TL fine for violation of the obligation to inform, while only 10,000 TL was issued to a gym that violated the same obligation. While the gym did not clarify the purposes of processing in its privacy notice, Amazon preferred to fulfill its obligation by using a general privacy statement, which is contrary to the information deemed necessary under KVKK. When the two decisions are evaluated together, it turns out that the same type of misdemeanor can cause different levels of violations in the practice of personal data protection. I believe it would be better to specify the limits of a fine in which the obligation to inform is violated in whole or in part or in some form of violation to be predefined by the board.

“Data breach notifications” have also been subject to fines many times. As per the fifth paragraph of Article 12 of KVKK, within the scope of the failure of the data controller's obligation for breach notifications, the board issued a principle decision to "avoid any inconsistency and to create a standard approach among the decisions to be taken." In that decision, the board ruled that data controllers must:

1. Interpret the deadline for breach notifications as 72 hours.
2. Report the reason for any delay where exists.
3. Use of a data breach notification form.
4. Log information relating to the breach.
5. Prepare a data breach response plan.

In the decision, the board also explained that the details of the above ruling will be considered in the calculation of fines due to the failure to fulfill the breach notification obligation. While the board is looking for consistency when imposing fines, the below examples will shed a light for controllers seeking standards on the fines issued by the board.

In the decision of Clickbus Travel Services, the board imposed a 100,000 TL fine for notifying the DPA and the data subjects two months after the deadline as per the fifth paragraph of Article 12 of KVKK. In a similar ruling, Marriot International was fined 350,000 TL as per the same article for late notification to the DPA and data subjects, three months and two months after the deadline, respectively. In another case, and under the same article, Cathay Pacific Airways received a 100,000 TL fine for being five months late to notify both the DPA and data subjects. The lax standards and unclarity challenge the controllers while creating big question marks.

A deeper analysis shows that the highest fines are given for data security violations. In its guide, issued for the necessary technical and administrative measures to ensure data security, the board expresses a variety of measures that will result in different risks. While the results for not taking these measures may vary depending on whether it lacks partly or in whole, a wide range of fines was defined in the KVKK for all data security violations as indicated in the below examples.

The data controller of an internet service provider’s online payment system was fined 300,000 TL due to lack of technical and administrative measures while fixing a flaw; in a decision against a bank, the data controller was fined 70,000 TL for a data leak the bank did not take necessary technical and administrative measures to fix; the board fined a tourism company 400,000 TL fine for not fulfilling the obligation to take the necessary technical and administrative measures against a penetration made into the employee network; and finally, Dubsmash paid 680,000 TL for the lack of technical and administrative measures after user data had been stolen. All administrative fines in the above cases were imposed as per the Subparagraph (b) of the first paragraph of Article 18 of KVKK, which regulates data security violations. It is still a mystery; what metrics are used when imposing these fines and the inability to predict administrative fines makes it impossible to calculate the risks.

Unlike the EU General Data Protection Regulation, the KVKK does not set a certain rate for the total annual turnover whether worldwide or local of a data controller. This means that the range between the lowest and highest values must be calculated with a consistent and robust methodology. I think data controllers would feel much more comfortable when trying to comply with the law, if the board disclosed the details of the methodology behind the administrative fines, if possible, by drafting a guideline similar to DSK in Germany.

Photo by Tarik Haiga on Unsplash