Category: Turkiye

A. Introduction: On November 1, 2018, Personal Data Protection Board (“Board”), acting under the Personal Data Protection Authority, published its principle decision with number 2018/119 in the Official Gazette, which then corrected on November 7, 2018 (“Decision”). Board’s Decision is regarding prevention of promotional notifications, e-mail messages, text messages and calls that data subjects might receive from data controllers and data processors.

B. Rationale

In the beginning of the Decision, the Board indicates that they received numerous complaints based on the Law No. 6698 on Protection of Personal Data (“Law No. 6698”) from individuals, who claim to have received promotional and advertorial calls, text messages, e-mail messages from parties, whom they did not give consent for such communications.

The Board also indicates that, upon receiving such complaints, an investigation has been conducted on the matter by the Board, results of which were used for determining the principles set forth in the Decision.

C. Obligations of Data Controllers & Processors

I. Cease of Activity

The Decision orders data controllers, which direct promotional communications to data subjects without obtaining data subjects’ consents or without meeting the conditions under Article 5/2 of the Law No. 6698, to immediately cease such processing activities immediately. Additionally, the Decision also orders data processors that send such communications on behalf of data controllers, to cease their data processing activities immediately, as well.

The Decision lists sending text messages to or calling data subjects phone numbers; and sending e-mails to data subjects; as methods of communication. Although, the wording of the Decision appears to be limited to these methods of communication, considering the purpose of Board’s decision, one might argue that the Board will highly likely apply this principle to every other form of electronic communication, provided that it is promotional and/or advertorial and the conditions of the Law No. 6698 are not met.

According to Article 5/2 of the Law No. 6698, it is possible to process personal data without the explicit consent of the data subject where one of the conditions below apply;

• it is explicitly foreseen by laws
• data has been made public by the data subject
• processing personal data of the parties of a contract is necessary, on condition that processing is directly related to the execution or performance of such contract
• processing is necessary for compliance with a legal obligation which the data controller is subject to
• processing is necessary for the establishment, exercise or defense of a legal claim
• processing is necessary for the purposes of the legitimate interests of the data controller, provided that such interests do not violate the fundamental rights and freedoms of the data subject
• processing is necessary to protect the vital interests or the bodily integrity of the data subject or of another person where the data subject is physically or legally incapable of giving his consent

In this order, the Board refers to its authority under Article 15/7 of the Law No. 6698, which entitles the Board to decide on cease of data processing or transfer of data abroad, if there is an obvious violation of laws and there are irrevocable damages or damages that are hard to recover. In that sense, one might argue that the Board evaluates such activities as violations of the Law No. 6698 and is inclined to interpret such activities as damaging to data subjects, which might be used against data controllers within the scope of claims by data subjects pertaining to non-pecuniary damages.

II. Precautions

By referring to Article 12 of the Law No. 6698, the Decision explicitly states that data controllers are obliged to take all technical and administrative measures in order to ensure an adequate level of security for the purposes of (i) preventing unlawful processing of personal data, (ii) preventing unlawful access to personal data; and (iii) protecting personal data.

Furthermore, it is also noted in the Decision that if personal data is processed by another real person or legal entity on behalf of the data controller, the data controller shall be jointly liable with the data processor for taking the foregoing measures.

III. Sanctions

The board states that they will impose the measures provided under Article 18 of the Law No. 6698 for those who conduct such processing activities, which sets forth administrative fines for those who fail to comply with certain obligations under the Law No. 6698. 

• Article 18/1(b): Those who fail to fulfill the obligations relating to data security referred to in Article 12 of this Law shall be subject to an administrative fine ranging from 15,000 Turkish Liras up to 1,000,000 Turkish Liras.
• Article 18/1(c): Those who fail to abide by the decisions rendered by the Board per Article 15 of this Law shall be subject to an administrative fine ranging from 25,000 Turkish Liras up to 1,000,000 Turkish Liras.

The Board also warns that, taking into account the possibility that personal data process for such activities might be collected unlawfully, they will notify the relevant public prosecutor’s office, so that criminal proceedings could be initiated for the crime of illegal dissemination and seizure of data in accordance with Article 136 of the Turkish Criminal Code, under which illegal seizure, transfer or dissemination of personal data constitutes a crime under and is subject to an imprisonment up to four years.

Although the Decision does not explicitly indicates any time period for data controllers and processors to cease their activities found to be in violation of the Law No. 6698, it is implied in the Decision that the Board is not eager to punish on-going activities of data controllers and processor, but merely confines itself to warn and urge them to cease such activities and act in accordance with their obligations within the scope of the Law No. 6698. 

IV. Checklist for Compliance

Please find below a short checklist of items that might be considered by data controllers before sending out promotional communications, for the purposes of compliance with the Law No. 6698 and Board’s principle decision.

1. Taken necessary precautions and measures to protect the contact information which will be collected from data subjects (such as creating a dedicated storage space for the relevant data, limiting the number of personnel accessing such data to senior marketing managers etc.),
2. Informed data subjects about using their contact information for promotional communications before or, at the latest, during collection of their personal data and recorded such notice for evidential purposes (be it on paper with data subject’s signature, a voice record or vie electronic logging),
3. If using contact information collected previously for other purposes where data subject might not be reasonably expected to know that it might be used for such communications, informed data subject about using their contact information for this new purpose, before starting processing activities for that purpose; and recorded such notice for evidential purposes,
4. Have a legal basis for using their contact information for such communications (please see the table above for the list of valid legal grounds),
5. If not, obtained data subject’s explicit consent; and recorded such consent for evidential purposes.

Please note that data processors should also consider whether the data controllers, on whose behalf they process personal data and send promotional communications, are in compliance with the Law No. 6698; and vice versa, since they are both jointly liable for violations of the Law No. 6698, as explained above.

In any case, it is clear that individuals are starting to take control of their personal data more and more, as legislations provide them with new ways to exercise their rights. The Board’s decision show that complaints from individuals impelled the Board to act on its authority and warn data controllers and processors about the current state of affairs with respect to their promotional activities.

(First published by Mondaq on February 6, 2019)

By Gonenc Gurkaynak, Partner, Ilay Yılmaz, Partner ELIG Gürkaynak Attorneys-at-Law

Overall, 2018 was a more active year in terms of Foreign Corrupt Practices Act (“FCPA”) enforcement actions compared to 2017. In 2018, the Department of Justice (“DOJ”) took a total of 40 enforcement actions, and the Securities and Exchange Commission (“SEC”) took a total of 14 enforcement actions.

According to the FCPA Blog’s 2018 FCPA Enforcement Index, 16 companies paid a total of $2.89 billion to resolve FCPA cases in 2018, including resolutions with the DOJ and the SEC, as well as DOJ declinations with disgorgement. As anticipated over the past few years, the Yates Memo might have arguably shown its effect, as 32 out of the 40 enforcement actions taken by the DOJ were related to real persons, most of which were related to multiple bribery schemes involving PDVSA, a Venezuelan state-owned oil and natural gas company. In terms of the sectoral concentration of FCPA enforcement actions in 2018, we observe that a wide array of sectors were affected by these actions, including the investment banking, petroleum and technology sectors.

DOJ Declination Decisions

In April 2018, the DOJ closed its investigation with regard to the Insurance Corporation of Barbados Limited (“ICBL”). According to the DOJ, ICBL had paid approximately $36,000 in bribes to Donville Innis, a member of the Parliament of Barbados and the Minister of Industry, International Business, Commerce and Small Business Development of Barbados, in exchange for government contracts worth $93,000 in profits. Under the terms of the declination pursuant to the DOJ’s Corporate Enforcement Policy, ICBL paid the DOJ about $93,900 in disgorged profits.

In April 2018, the DOJ closed its investigation with regard to Dun & Bradstreet, which is a company that provides commercial data and analytics services for businesses. According to the U.S. government, two Dun & Bradstreet subsidiaries in China made bribery payments to Chinese government officials. In its resolution with the SEC, Dun & Bradstreet agreed to pay over $9 million in disgorgement. According to the DOJ, the declination decision was based on, among other factors, (i) Dun & Bradstreet’s identification of the misconduct, (ii) its prompt and voluntary self-disclosure, (iii) thorough investigation, (iv) full cooperation, and (v) the fact that it had agreed with the SEC to disgorge profits, despite the acts of bribery committed by the employees of Dun & Bradstreet’s subsidiaries in China.

In August 2018, the DOJ closed its investigation with regard to Guralp Systems Limited (“GSL”), an engineering company based in the U.K., even though there was evidence of violations of the FCPA arising from the payment made by GSL to Heon-Cheol Chi, the director of the Earthquake Research Center at the Korea Institute of Geoscience and Mineral Resources. According to the DOJ, several reasons lead to the declination decision, such as GSL’s (i) voluntary disclosure of the misconduct, (ii) significant remedial efforts, and (iii) being the subject of an ongoing parallel investigation by the U.K.’s Serious Fraud Office for violations of law relating to the same conduct, and its commitment to accepting responsibility for that conduct with the Serious Fraud Office.

DOJ Enforcement Actions

In March 2018, Transport Logistics International Inc. (“TLI”), a company providing services in the field of transportation of nuclear materials, agreed to resolve criminal charges in connection with a conspiracy involving the bribery of an official at a subsidiary of Russia’s State Atomic Energy Corporation for awarding uranium transportation contracts, and also to pay a $2 million criminal penalty. TLI entered into a three-year deferred prosecution agreement (“DPA”) with the DOJ. As per the DPA, the $2 million penalty amount is based on TLI’s financial inability to pay the penalty set forth under the U.S. Sentencing Guidelines. TLI also committed to cooperate fully with the ongoing investigation, and to continue to implement a “compliance and ethics” program, designed to prevent and detect violations of the FCPA and other anti-corruption laws throughout its operations.

In March 2018, Eberhard Reichert, a former Siemens AG executive who worked for the company between 1964 and 2001, pleaded guilty and entered into a plea deal with the DOJ, for conspiring to violate the FCPA’s anti-bribery, internal controls, and books and records provisions. The charges in this case involved making bribery payments to officials in ten countries, including to Argentine government officials, for $1 billion worth of contracts in order to create national identity cards, and using shell companies controlled by intermediaries to disguise and launder the funds.

In April 2018, Panasonic Avionics Corporation (“Panasonic Avionics”), a subsidiary of the multinational electronics company, Panasonic Corporation (“Panasonic”), agreed to pay a criminal penalty of $137,400,000 to resolve charges arising out of a scheme to retain consultants of its U.S. in-flight entertainment unit in the Middle East and Asia for improper purposes and to conceal payments to third-party sales agents between 2007 and 2016, in violation of the accounting provisions of the FCPA. According to the investigated party’s admissions and court documents, Panasonic Avionics had knowingly and willfully caused Panasonic to falsify its books and records with respect to Panasonic Avionics’ retention of consultants for improper purposes. Panasonic Avionics also entered into a DPA with the DOJ, which requires the company to be supervised by an independent monitor for at least two years.

In June 2018, Société Générale S.A. (“Société Générale”), a global financial services company based in Paris, France, and its subsidiary, SGA Société Générale Acceptance N.V., agreed to pay a combined total penalty of more than $860 million to settle with criminal authorities in the United States and in France, to resolve charges arising out of bribery payments to government officials in Libya. Société Générale entered into a DPA with the DOJ and it also reached a settlement with the Parquet National Financier (“PNF”) in Paris. The United States will credit $292,776,444 that Société Générale will pay to the PNF under its agreement, equal to 50 percent of the total criminal penalty payable to the United States. According to the DOJ, this is the first coordinated resolution with French authorities in a foreign bribery case.

In August 2018, Legg Mason Inc. (“Legg Mason”), an investment management firm based in Maryland, entered into a non-prosecution agreement (“NPA”) with the DOJ by agreeing to pay $64.2 million to resolve charges relating to violations of the FCPA in Libya, as well as a civil penalty of $34 million to the SEC, in order to disgorge $27.6 million of ill-gotten gains and pay $6.9 million in prejudgment interest to settle the SEC’s case. According to the DOJ and the SEC, Permal Group Inc., a former subsidiary of Legg Mason, partnered with a French financial services company to solicit investment business from Libyan state-owned financial institutions and engaged in a scheme to pay bribes to Libyan government officials through a Libyan middleman in order to secure investments. As a result of the bribery scheme, Legg Mason was awarded investments by the Libyan financial institutions, in the amount of $1 billion. 

In September 2018, Petróleo Brasileiro S.A. (“Petrobras”), a Brazilian state-owned and state-controlled energy company, entered into an NPA with the DOJ, and also reached an agreement with the Brazilian authorities, agreeing to pay a combined total of $853.2 million in penalties to resolve charges relating to violations of the FCPA. To resolve the SEC investigation, Petrobras agreed to pay an additional $933 million in profit disgorgement and prejudgment interest. According to the DOJ and the SEC, Petrobras executives, who consisted mostly of company board members, facilitated bid-rigging and bribery schemes by enabling their contractors to inflate the contracts for their infrastructure projects, where the contractors made facilitating payments to the Brazilian politicians and political parties responsible for appointing the Petrobras executives to their positions in exchange for the inflated contracts.

SEC Enforcement Actions

In March 2018, Kinross Gold Corporation (“Kinross Gold”), a Canada-based gold and silver mining company, paid a civil penalty of $950,000 to settle the SEC’s charges for violating the FCPA’s books and records and internal accounting controls provisions, arising from the company’s repeated failure to implement adequate accounting controls for two African subsidiaries. According to the SEC, Kinross had acquired two African mining companies in 2010, operating in Mauritania and Ghana, which lacked the requisite anti-corruption compliance programs and internal accounting controls. Kinross Gold was able to implement adequate controls in three years; however, the company failed to subsequently maintain these controls. For example, Kinross Gold awarded a logistics contract to a company preferred by Mauritanian government officials. Furthermore, it paid vendors and consultants without making sure that the payments were consistent with its anti-bribery compliance policies.

In March 2018, Elbit Imaging Ltd. (“Elbit”), an Israel-based company operating in the real estate, medical imaging, hotels, shopping malls, and retail sectors, agreed to pay a $500,000 penalty to the SEC to resolve charges relating to violations of the FCPA’s books and records and internal accounting controls provisions. According to the SEC, Elbit and its indirect subsidiary, Plaza Centers N.V., made large amounts of payments to third-party offshore consultants and a sales agent, for services related to a real-estate development project in Romania and the sale of a large portfolio of real-estate assets in the U.S., without knowing if the contracted services were actually provided. The companies also failed to accurately record these payments in their books and records, in a manner that fairly reflected their true nature.

In July 2018, Beam Suntory Inc. (“Beam”), a subsidiary of Suntory Beverage & Food Ltd., based in Chicago, which is a subsidiary of Suntory Holdings of Osaka, Japan, paid the SEC $8.2 million to resolve charges relating to violations of the FCPA, stemming from the improper payments made by its Indian subsidiary to government officials in India. According to the SEC, Beam’s Indian subsidiary had used third-party sales promoters and distributors to make illicit payments to government employees between 2006 and 2012, in order to (i) increase sales orders, (ii) process license and label registrations, and (iii) facilitate the distribution of Beam’s distilled spirit products.

In September 2018, one of the biggest pharmaceutical companies in the world, Sanofi S.A. (“Sanofi”), based in Paris, France, agreed to pay $25.2 million (comprising a civil penalty of $5 million, $17.5 million in disgorgement payments and $2.7 million in prejudgment interest) to resolve charges relating to violations of the FCPA’s books and records and internal accounting controls provisions, as a result of its subsidiaries in Kazakhstan and the Middle East bribing officials to win business contracts. According to the SEC, the bribery schemes spanned multiple countries and involved illicit payments to government procurement officials in Jordan, Lebanon, Syria, Bahrain, Kuwait, Qatar, Yemen, Oman, and the United Arab Emirates, in order to be awarded tenders and to increase prescriptions of its products. In March 2018, the DOJ had closed its four-year FCPA investigation without deciding to bring an enforcement action.

In September 2018, United Technologies Corporation (“United Technologies”), a Connecticut-based company providing high-technology products and services to the building systems and aerospace industries, settled charges with the SEC that it had violated the FCPA by making illicit payments in its elevator and aircraft engine businesses. United Technologies agreed to pay $13.9 million to resolve charges that its actions had violated the FCPA. According to the SEC, its subsidiary, Otis Elevator Co., had made payments in bribes to Azerbaijani officials to facilitate elevator equipment sales in Baku, and had also paid a Chinese sales agent in order to obtain confidential information from a Chinese official to help win engine sales contracts from a state-owned Chinese airline.

In September 2018, Stryker Corporation, a company based in Michigan operating in the medical device sector, agreed to settle with the SEC and pay a $7.8 million penalty to resolve charges relating to the FCPA’s books and records and internal accounting controls provisions. According to the SEC, Stryker’s internal accounting controls were not sufficient to detect the risk of improper payments in sales of Stryker products in India, China, and Kuwait, and Stryker’s Indian subsidiary had failed to maintain complete and accurate books and records. Stryker had also been charged by the SEC back in October 2013, with respect to bribery payments made by its subsidiaries in five different countries to doctors, health care professionals, and other government-employed officials in order to obtain new business or retain existing business relationships.

On November 19, 2018, Vantage Drilling Company (“Vantage”) agreed to pay $5 million to the SEC in disgorgement for violations of the FCPA’s internal accounting controls provisions, regarding its failure to properly implement and maintain a system of internal accounting controls related to its use of third-party marketing agents. According to the SEC, Vantage lacked sufficient internal accounting controls in relation to the heightened risk of conducting business in the oil and gas industry in Brazil.

(First published by Mondaq on January 16, 2019). 

By Gonenc Gurkaynak, Partner, Ceren Yıldız, Counsel, Nazlı Gurun, Associate ELIG Gürkaynak Attorneys-at-Law

In May 2017, Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices (“EU Regulation”) entered into force, stipulating a transition period for medical device manufacturers to comply with the EU Regulation by May 2020. As the title of the EU Regulation suggests, it lays down enhanced rules on medical devices, manufacturers, distributors, importers, and notified bodies. For any medical device to be put into and sold on the market, full compliance with the EU Regulation is required. The EU Regulation introduces and addresses several new principles and renders procedures pertaining to medical devices more transparent, trackable and predictable. These changes aim to ensure a high level of safety and protection for patient health and for the users within this industry, also taking into consideration the technological evolution and developments in this field.

In Turkey, the Medical Device Regulation, which is based on the Council Directives 90/385/EEC and 93/42/EEC and which entered into force on June 7, 2011, is currently still in force and effect. Recently, a draft Medical Device Regulation (“Draft Regulation”) has been prepared and announced by the Turkish Ministry of Health, with the intention and purpose of harmonizing and aligning the Turkish regulatory framework for medical devices with the new EU regulations. 

The Draft Regulation contains requirements that are in parallel (indeed, almost identical) to those put forth by the EU Regulation, while also addressing a few local issues and principles that are specific to Turkey. A translated version of the EU Regulation was first published on the official website of the Turkish Medicines and Medical Devices Agency (“Agency”), the authorized body for the enforcement of the Draft Regulation, and was opened to public comment in order to receive and gather opinions from interested parties. Subsequently, the Draft Regulation was published on the Agency’s official website, requiring interested parties to convey their ideas, suggestions and comments to the Agency by November 16, 2018. 

In this regard, it is safe to say that the Draft Regulation contains very similar regulations—even direct translations—to those set out in the EU Regulation. Accordingly, certain significant changes that have been introduced through the Draft Regulation are summarized below:

• Addressing a critical issue, the Draft Regulation clearly prohibits labels, usage instructions and advertisements relating to a device’s intended purpose, safety and performance from including misleading texts, names, trademarks, pictures, and figurative or other signs by (i) ascribing functions and properties to the device that the device does not possess, (ii) creating a false impression regarding any functions or properties related to treatment or diagnosis that the device does not have, (iii) failing to inform the user or patient of a potential risk associated with the use of the device in line with its intended purpose, and (iv) suggesting areas of use for the device other than those specified to form part of the intended purpose for which a conformity assessment has been carried out.
• Another significant change introduced by the Draft Regulation pertains to the obligations of manufacturers, importers and distributors, as the current Medical Device Regulation (which is still in effect) contains several provisions with respect to manufacturers’ obligations under a number of articles, but little to no regulation with respect to those of importers and distributors. In this regard, the obligations of manufacturers, importers and distributors are increased and become more detailed through the Draft Regulation. In this context, manufacturers are required to prepare and to regularly update the EU declaration of conformity. They are also required to fulfill their obligations with respect to (i) establishing a risk-management system, (ii) conducting a clinical evaluation for tracking their devices that have been put into market, (iii) preparing and updating the technical documentation of their devices, and (iv) establishing a quality-management system. Manufacturers must retain and have available at least one person within their organization who will be responsible for regulatory compliance, and who must possess specific qualifications. In the event that the manufacturer of a device does not reside in Turkey or in an EU Member State, the device may only be put into market by the authorized representative of the manufacturer. Increased and enhanced responsibilities have also been placed upon the importers and distributors of medical devices.
• The Draft Regulation also comprises several changes in relation to the medical devices. While the product classifications remain the same, certain new procedures have been introduced with respect to the registration of the devices. The current Medical Device Regulation simply requires the Ministry of Health to ensure the local registration and evaluation of certain information pertaining to devices, whereas the Draft Regulation, parallel to the EU Regulation, introduces international registry systems, such as the Unique Device Identification (UDI) and EUDAMED schemes, on top of the local registration requirement.
• The Draft Regulation also addresses issues relating to confidentiality and data protection, and requires the protection of personal data, commercially confidential and sensitive information, and information obtained during inspections, investigations, or audits. 

As the notified bodies (which are currently authorized to grant the conformity certificate for medical devices to manufacturers) will also be required to meet and fulfill additional specifications in order to obtain their licenses and to continue operating, the Draft Communiqué on Notified Bodies Operating in the Medical Device Sector (“Draft Communiqué”) has been prepared and published on the Agency’s official website as well. The announcement of the Draft Communiqué also includes a comparison chart with the relevant articles of the EU Regulation, indicating that the Draft Communiqué has been prepared based on the EU Regulation.

The publication and enforcement dates of the Draft Regulation and the Draft Communiqué have yet to be announced. However, in light of the extensive similarity between the Draft Regulation and the EU Regulation, and considering that the EU Regulation provides a transition period of three years, we might reasonably anticipate that the Draft Regulation will stipulate a similar transition period for compliance after entering into legal force.

(First published by Mondaq on January 8,  2019)

By Gonenc Gurkaynak, Partner, Ceren Yıldız, Counsel, Nazlı Gurun, Associate ELIG Gürkaynak Attorneys-at-Law