Turkey Places Data Localization Requirement on Social Network Providers

Written by: Brett Lawrence, Esq.

Last December, we discussed India’s proposed Personal Data Protection Bill and the implications of its data localization requirement. It appears Turkey has now promulgated a similar requirement.

Overview

On July 29, 2020, Turkey’s legislature, the Turkish Grand National Assembly, approved the passing of Law No. 5651, an amendment to the country’s “Regulation of Internet Broadcasts and Prevention of Crimes Committed through Such Broadcasts.” On October 1, 2020, this amendment went into full force and effect.

Law No. 5651 creates a new actor called a “social network provider,” defined as “natural or legal persons that provide opportunities for users to create, view or share textual, visual, audio, or location data, etc. for social interaction.” Among other things, Law No. 5651 requires providers to (1) appoint local representatives; (2) have notification, reporting, and content removal procedures; and (3) provide reports prepared in Turkish to Turkey’s Information Technologies and Communications Authority (“ICTA”) every six months.

Localization Requirement

The critical feature of Law No. 5651 is the new data localization requirement imposed. Social network providers who have over one million daily users of their services now must implement necessary measures to store the data of their Turkish users in Turkey. In doing so, social network providers must include information on the data localization measures they have taken in their semiannual reports to show their compliance. The localization requirement applies to all Turkish citizens, with an exception to Turkish nationals and those citizens residing abroad. It remains to be seen, however, whether this localization requirement allows for merely storing a copy of the data locally, rather than storing the data in its entirety.

What This Means Going Forward

Although Law No. 5651 clearly applies to the likes of Facebook, Twitter, and Instagram, smaller businesses that fit the definition of “social network provider” must be cognizant of this localization requirement. Considering the fact the Turkey is among the top ten countries using social media networks, such providers may have to establish physical storage capabilities in Turkey sooner rather than later