In a great development for many people residing in Turkey, PayPal and Apple Pay are making their anticipated return, opening up new avenues for advanced payment systems within the country.
Turkey is set to welcome the return of PayPal and the introduction of the NFC-based payment service, Apple Pay, on iPhones, signaling a new era for advanced payment systems in the country.
Following a period of unavailability, PayPal and Apple Pay, alongside other international corporations like Meta and X (formerly known as Twitter), are poised to re-enter the Turkish market thanks to a newly published law. This legislation appears to remove previous barriers, paving the way for these payment giants to operate freely within Turkey.
A significant amendment to Article 9 of Law No. 6689, as published in the Official Gazette, now allows global companies based outside Turkey to store personal data of their users in their respective countries, provided they meet the required qualifications. This change marks a pivotal shift in the data privacy landscape, potentially benefiting companies like Meta, X, PayPal, and Apple Pay.
Previously, entities like PayPal and Apple Pay faced regulatory hurdles from the Banking Regulation and Supervision Agency (BDDK) and were reluctant to store any personal data within Turkey due to privacy concerns.
Summary of Changes to Article 9 of the Law on the Protection of Personal Data (No. 6698):
Adequacy Decision: If the Personal Data Protection Board issues an adequacy decision for the country, sector, or international organization in question, data controllers and processors can transfer data to that country. Adequacy decisions are reviewed every four years and may be modified, suspended, or revoked as necessary.
Criteria for Adequacy Decisions Include:
- Reciprocity in personal data protection laws and practices.
- The presence of an independent and effective data protection authority.
- Membership in international treaties and global or regional organizations.
In the Absence of an Adequacy Decision: Data can be transferred if one of the following appropriate safeguards is provided:
- Non-contractual international agreements and Board permission.
- Binding corporate rules and Board approval.
- Standard contractual clauses announced by the Board.
- Written commitments providing adequate protection and Board permission.
Exceptional Circumstances for Data Transfer:
- Explicit consent of the individual.
- Necessity for contract performance or pre-contractual measures.
- Obligation for the protection of a person’s interests.
- Public interest or legal requirement.
- Emergencies.
- Transfers from public registries.
Further Considerations:
- The Board may authorize data transfers if Turkey’s or the individual’s interests are seriously harmed.
- Other laws concerning the transfer of personal data abroad remain applicable.
- Regulations governing the implementation of this article will be established by regulation.
