Mandatory deadlines for registration at VERBIS have been announced. Making a statement on the subject, Av. Burcu Kırçıl emphasized that administrative fines and also imprisonment sanctions may be imposed in case of operating outside the framework of the Law.
With the pandemic happening all over the world, the importance of KVKK has also increased with the fact that we are more involved in processes where personal data are compromised in many areas from e-commerce to live broadcasts, from distance education to participating in online meetings. Stating that the business and communication world, which has not yet been able to implement KVKK compliance today, has created an efficient base for cybercrime, and as a result, there is a great increase in cyber crimes, Kırçıl Law Firm Founder and Manager Av. Burcu Kırçıl made statements about the subject.
For data security in Turkey, which came into force on April 7 2016 6698 No. enterprises to adapt to the Law on Protection of Personal Data 2 years that recognized "Extension of Data Specialist Registrar on the record date" on 2020/482 Decree No 25 June 2020 and 31166 2016 Stating that the mandatory deadlines for registration to VERBIS have been announced in the Official Gazette no. Burcu Kırçıl said that although the Law entered into force in XNUMX, the lack of sufficient information prevented the registration obligation from being fully implemented.
Hunting. Burcu Kırçıl stated the dates of the decision as follows:
- The period given to real and legal person data controllers with an annual number of employees more than 50 or an annual financial balance of more than 25 million TL to fulfill their registration and notification obligation to the Registry until 30.09.2020,
- The annual number of employees is less than 50 and the annual financial balance sheet total is less than 25 million TL and the deadline for real or legal person responsible persons whose main activity is the processing of special quality personal data to fulfill their registration and notification obligation to the Registry is 31.03.2021,
- The period given to public institutions and organizations data controllers to fulfill their registration and notification obligation to the Registry is 31.03.2021.
In the present case the 55 thousand companies in Turkey that it is planned to enroll verbis, but who says that only 25 thousand companies spent record Verbiste Ava's life. Burcu Kırçıl continued his words as follows: “Another issue perceived incorrectly by companies is to think that the process is completed by registering VERBIS and publishing the clarification text. This thought interrupts the purpose of the Law. The law defines the adaptation process by requiring technical and administrative measures to be taken at every stage and department where personal data is engaged, and by considering the principle of privacy of private life specified in the constitution for the processing and protection of personal data and special quality data. It is also useful to remember that administrative fines and also imprisonment sanctions may be imposed in case of operating outside the framework set by the law.
Hunting. Burcu Kırçıl also stated that the penal sanctions applied in case of violation of the law vary according to the revaluation rate every year and gave information as follows:
- The penalty for not fulfilling the lighting obligation is between 9 thousand TL-180 thousand TL
- Failure to fulfill the decisions made by the Board between 45 thousand TL - 1 million 800 thousand TL
- Failure to fulfill obligations regarding data security between 27 thousand TL - 1 million 800 thousand TL
- Violating the registration and notification obligation of the Data Controllers Registry (VERBIS) between 35 thousand TL - 1 million 800 thousand TL
The violations of the Law foreseen for imprisonment are as follows:
- Unlawful recording of personal data 1-3 years imprisonment
- Providing, distributing or obtaining personal data illegally to another person, 2-4 years imprisonment
- Not destroying the data despite the expiration of the time, 1-2 years imprisonment
- A prison sentence of 1,5-4,5 years is imposed for the illegal recording of private personal data.
Stating that being able to ensure the compliance process and sustainability of the law, the limited calendar or budgets that can be allocated to such adaptation studies in a period of economic contraction with the coronavirus epidemic disrupts the adaptation process. Burcu Kırçıl stated that it is clearly seen that the Personal Data Protection Law and what it brings with it are still not fully assimilated even in large companies, and said, “The opinion that the personal data processing processes will be fulfilled by preparing a few printed documents and having them signed by the relevant persons. unfortunately it still continues. The information entered into this system is only possible with correct information entry, which includes the inventory and summaries that reflect the company's general practices. Otherwise, there may be extremely serious sanctions due to incomplete or incorrect information entered into the system ”.
Underlining that each institution should prepare a detailed "Personal Data Processing Inventory" in compliance processes by consulting from persons and entities who are competent in legal and technical matters, and carry out the registration of VERBIS according to the data in this inventory, and take necessary measures in administrative and technical matters. Burcu Kırçıl emphasized the importance of organizing “KVKK Awareness Trainings” for employees in order to ensure the sustainability of the KVKK compliance process.
Be the first to comment