Guideline on Banking Sector Best Practices Regarding Personal Data Protection Has Been Published

On 05.08.2022, the Personal Data Protection Authority (“Authority”), published Guideline on Banking Sector Good Practices Regarding the Personal Data Protection (“Guideline”). The purpose of the Guideline is guiding data controller banks regarding the personal data processing activities carried out by banks in accordance with the legislation and providing banks best practice examples. The issues stipulated in the Guideline are summarized below:

In the Guideline, it is highlighted that banks process data with great intensity, and categories of processed personal data have been diversified with the proliferation of especially the applications of digital banking and open banking. Moreover, it is emphasized that personal data, particularly special categories of personal data, which may cause irreparable damage to the data subjects in case of a breach, are also processed within the scope of banking activities.

In addition, it is also stated that working groups were established within the cooperation of the Authority and the Banks Association of Turkey and the relevant Guideline was prepared with the working groups, in cooperation with the banking sector and thus, best practices are created.

In general, the Guideline provides detailed explanations and implementation examples with regard to the aspects of personal data protection law concerning the banking sector. In this scope: (i) relationship between data controller - data processor; obligations of data controller banks within the scope of banking activities, (ii) conditions of processing personal data and sector-specific examples, (iii) conditions of explicit consent and methods of obtaining explicit consent, (iv) the relationship between the provisions of the Banking Law No. 5411, the Regulation on the Sharing of Confidential Information and the personal data protection legislation; and which regulation will take precedence in the transfers to be made, and (v) other obligations arising from the legislation, etc. are explained.