The Regulation on the Protection and Processing of Data Within Social Security Institution ("SSI") ("Regulation")entered into force after being published in the Official Gazette dated 02.19.2022 and No. 31755. Within the scope of this Regulation, the procedures and principles to be followed in the processing of the personal data obtained by the SSI is determined.

What are the Highlights of the Regulation?

In the Communiqué on the Procedures and Principles Regarding the Personnel Certification Mechanism published in the Official Gazette dated 06.12.2021 and numbered 31681, it has stated that those who want to entitled as Data Protection Officer should firstly have a "participation certificate" and in this context, the procedures and principles would be stated and published by Turkish Personal Data Protection Board ("Board").

It is stated that as a result of the investigation of the Authority within the scope of the notices submitted to the Authority, the software provided by the software firms to the automobile renting companies and the negative experiences of the rent holders during their automobile rental period and the comments of the automobile rental companies for the next renting processes can be viewed by another automobile renting companies in the rental situation, and the lessor is not aware of the processing of this knowledge.

It is stated that once an evaluation is made case-by-case basis between the fundamental rights and freedoms of the person and the legitimate interests of the data controller, the blacklist application is applicable within the data controller company, but if the processed personal data is shared with the other firms, the fundamental rights and freedoms of the data subject will be violated, and commitment to the purpose, limitation and it has been evaluated that is incompatible with the principle of proportionality. In the Decision, it is also stated that the processing of personal data within the scope of the blacklist will prevent the data subject from exercising their rights since they cannot know other automobile renting companies that their personal data were shared with it.

Certain periods and deadlines stipulated in Turkish Data Protection Law (KVKK) for VERBIS registration with the decision dated 19.07.2018 and numbered 2018/88. Afterward, these periods were extended 4 times, and the deadlines were postponed for various reasons.

With the decision numbered 2018/88, the deadline for VERBIS registration was determined as 30.09.2019 for data controllers with an annual number of employees over 50 and for data controllers residing abroad.

With the decision numbered 2019/265, the deadline for the above-mentioned data controllers was determined as 31.12.2019; with the decision numbered 2019/387 it was extended as 30.06.2020; with the latest decision numbered 2020/482, it was determined 30.09.2020 and lastly, it was determined as 31.12.2021 with the latest decision numbered 2021/238.