Privacy in Turkish Telecommunication Sector

[admin]

Ordinance on Personal Information Processing and Protection of Privacy in The Telecommunications Sector

PART ONE
General Provisions
Purpose and Scope
Article 1- The purpose of this ordinance is to define the procedures and principles
related to guaranteeing personal information processing and protection of privacy in the
telecommunications sector.
This ordinance covers real and legal persons providing or using services in the
telecommunications sector.
Legal Basis
Article 2- This Ordinance is prepared on the basis of Telegram and Telephone Law No:
406 of 4/2/1924 and Wireless Law No: 2813 of 15/4/1983.
Definitions
Article 3- The definitions and abbreviations used in this Ordinance have the following
meanings;
a) Board: Telecommunications Board,
b) Authority: Telecommunications Authority,
c) Subscriber: The real or legal person who signs a agreement with an operator
providing telecommunication services to benefit from a related service,
d) Buyer: All kinds of real or legal persons and all kinds of public organizations
which have accessible personal information except the organizations which have
personal information only accessible by means of official ways,
e) Call: A connection used for communication performed by using a public
telecommunication service,
f) Interconnection: Contact between two different telecommunication networks to
perform the telecommunications traffic,
g) Electronic Mail: A written, voice or image message sent over network which can
be stored in network or terminal equipment of buyer before the moment which the
telecommunication service user takes it,
h) Operator: Profit oriented firm including Türk Telekom which provides
telecommunication services using a duty agreement, privilege agreement and/or
license or general permission,
i) Making Anonymous: Hiding the appearance or view of private information
about the calling or called party,
j) Value Added Telecommunication Services: Telecommunication services
performing computer or other processes over the form, content, code, protocol and
similar matters of each kind of message including the voice and data transmitted
between subscribers and conveying a different or a restructured message to the
user of subscriber or Telecommunication services providing transmission between
subscribers by means of loaded or saved messages and data,
k) Personal Information/Data: Any information related with real and/or legal
persons which can be defined directly or indirectly by using one or more elements
of identity card number or physical, psychological, intellectual, economic, cultural
and social identities or health related, genetic, ethnic, religious, family related and
political information,
l) Personal Information Processing: Automatically or not, any process or a sum of
processes which are performed over personal information by gathering, saving,
preparing, adopting, changing, calling back, consulting, using, making known by
transferring, broadcasting or making accessible by means of any other way,
arranging, merging, blocking and erasing,
m) Short Message: A service that creates the opportunity of sending and receiving
written short messages to the user using a telecommunications equipment,
n) User: Real or legal persons, whether they are subscriber or not, benefiting from
telecommunications services,
o) Network: The net of any communications system including switching equipment
and lines used for providing telecommunications between one or more locations,
p) Traffic Data: Any processed data for billing or the transmission of
communication,
q) Telecommunications: Sending and receiving each kind of sign, symbol, voice and
picture and each kind of data that can transformed to electrical signal by means of
cable, radio, optical, electric, magnetic, electro-magnetic, electro-chemical,
electro-mechanic and other ways,
r) Telecommunication Service: Providing the whole or partial activities as services
which are contained in the definition of Telecommunications.
s) Third Party: Public organizations and any type of real or legal persons or the
persons related with data, any organization or person except the ones authorized
for processing the data under the supervisory of Authority or operator,
t) Location Data: Any kind of data processed in the network to determine the
location of telecommunications equipment that is belonging to a publicly open
telecommunications service.

PART TWO
Basis of Application
Application
Article 4- This ordinance is used for personal information processing and protection of
privacy related with providing telecommunications service in networks.
Application Scope
Article 5- Article 12, 13, 14 and 18 of this ordinance is only applied for the subscribers
who benefit from the service using digital telephone exchanges and suitable signaling systems.
If it is technically impossible or too expensive to apply this article, operators inform
Authority about this situation with a justification. If the Authority determines that the
situation brings technical impossibility or extra financial burden. These articles are not put
into practice.

Security
Article 6- Operators shall take the approval of Authority for the technical and structural
measures of network security which are aimed at providing the security of their services.
Informing About The Risks
Article 7- If there is a possibility of violation in the security of network creating
extraordinary risks which are beyond the measures taken by the operator, operators shall
immediately inform the subscribers about the risks and the ways of eliminating them.
Secrecy of Telecommunications
Article 8- Listening, saving, keeping, stopping and supervision of telecommunications
by third parties is strictly prohibited without the permission of all the parties involving in
communication except the cases depending on laws and court orders.
Saving, keeping and supervision of related traffic data in a way that is not consistent
with the service aims is also strictly prohibited.

PART THREE
Traffic Data
Approval and Period
Article 9- If the subscribers or users approve the usage of their personal data for
marketing telecommunication services or providing value added service, operators can only
process these data in the period required for marketing. Subscribers and users can always
cancel their approval for the processing of their data.
Operators shall inform subscribers or users about the period and type of process for
marketing or providing value added services.
Authorization To Process Traffic Data
Article 10- Authorization to process traffic data belongs to people authorized by
operators and people performing billing, organizing traffic, working for customer
relationships, determining illegal act, marketing electronic telecommunications services and
providing value added services.
Informing Authorities
Article 11- Traffic data can be given to a court or a real or legal authority in charge of
solving the problems related with interconnection, billing or similar disagreements.
Itemized Billing
Article 12- Subscribers have a right to obtain itemized or unitemized bills according to
their demands.
Prevention Of Revealing The Identity Of Caller Party
Article 13 – Operator shall enable the user who makes the call to prevent the calling
line's identity from being disclosed, by a simple method and without charging any money for it.

Barring Connection Of The Caller's Line
Article 14 – Where identity of the caller line is hidden, operator enables the subscriber
who is called to refuse upcoming calls by a simple method and free of charge.
Location Data
Article 15 – Where, in connection with users and subscribers of telecommunication,
location data can also be processed other than traffic data, such data may only be processed in
a scope and time in which subscribers and users are made anonymous or time that is required
for provision of a value-added service, and by agreement of subscribers and users. Prior to
obtaining such agreement, operator has to inform users and subscribers of type of location
data other than traffic data, time and purpose of the processing and whether it shall be sent to
third parties for the purpose of providing value-added service. Users and subscribers shall
always be free to withdraw their consent to processing location data.
Provisional Refusal
Article 16 – When approval is obtained with regard to processing of location data of
users or subscribers, such users and subscribers shall be furnished with the ability to
provisionally refuse processing of such data for each connection to the network and/ or
telecommunication transmission, by a simple method and free of charge.
Limitation To Number Of Persons
Article 17 – Processing of location data other than traffic data is limited to the persons
under the authority of the network and/ or operator or the third parties that provide valueadded
service. However, such limitation should be made according to the nature of provision
of value-added service and to an extent entailed by its purpose.
Exceptional Situations
Article 18 – Operators pursue a transparent policy in the following exceptional
situations:
a) Where identity of caller line is provisionally disclosed upon application by subscriber
for the purpose of surveilling ill intentioned or disturbing calls, information containing
identity of calling subscriber should be kept and made accessible by the network and/
or operators in conformity with the legislation.
b) In order to enable governmentally-recognized authorities and agencies to respond to
emergency calls, including security forces, ambulance and firefighting services,
information including location data and identity of the caller line for disclosure or
processing of caller line shall be kept and made accessible, on a single-line basis, even
if user or subscriber does not consent thereto.
Directories Prepared For Subscribers
Article 19 – Subscribers shall be provided with the information as to purpose of
publishing written and electronic subscriber directories, free of charge, prior to registration
process.
Subscribers are always free to request correction, verification or exclusion of their subscriber
information in the directories without any charge.
Additional consent of subscriber is required for directory services further than access to
personal information of subscribers based on names and surnames.
Unwanted Communications
Article 20 – Operators may not use automatic calling systems such as fax devices,
electronic mail, short messages that do not require user control as a means to perform direct
marketing or political propaganda. Furthermore, subscribers shall be furnished with means to
refuse to admit each received message in the future, by a simple way without any charge.
Electronic mails, which are sent for direct marketing and hide sender identity that would
indicate with whom communication is made or which fail to possess an address from which
receiver of such mail request termination of communication in question, shall be barred.
Technical Characteristics And Arrangements
Article 21 – Operators supply terminal equipment required for processing and
protecting privacy of personal information.

PART FOUR
Other Provisions
Provisional Article 1 – Personal information of subscribers of fixed or mobile
telephony system, whose information has been available in public directories prior to
publication of this Regulation, shall remain available in electronic or printed directories until
such time that they request otherwise.
Coming Into Force
Article 24 – This Regulation shall come into force as of the date of publication.
Enforcement
Article 25 – Provisions of this ordinance shall be enforced by Chairman of
Telecommunication Board.