Review of the ICTA’s Decision on Procedures and Principles for Social Network Providers
The Information and Communication Technologies Authority (the "ICTA" or the "Authority") published the Decision on "Procedures and Principles for Social Network Providers" ("Recent Decision") in the Official Gazette on 01.04.2023. With the Recent Decision, the decision on "Procedures and Principles on Social Network Providers" published by the ICTA in the Official Gazette on 02.10.2020 ("Abrogated Decision") has been repealed.
Law No. 7418 dated 13.10.2022 on the Amendment of the Press Law and Certain Laws introduced certain amendments and additional provisions to Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications ("Law"). Based on these amendments and additional provisions in Annex-4 of the Law, the ICTA issued the Recent Decision and repealed the Abrogated Decision dated 02.10.2020 on the same subject.
Herewith, we will try to analyze the obligations imposed on "social network providers", which most of us refer to as "social media platforms" in our daily lives, by comparing them with the Abrogated Decision of the ICTA dated 02.10.2020 and by including the new sanctions envisaged for breach of obligations.
The Law defines a social network provider as "natural persons or legal entities who enable users to create, view or share content such as text, image, sound, location on the internet for social interaction purposes". In the Recent Decision published by the ICTA following the amendment to the Law, it is seen that many new obligations are imposed on social network providers. Accordingly, it is seen that social network providers are obligated to provide information to judicial authorities, to create an advertising library, to provide children-specific segregated services, to host users' data in Turkey, the nature and publication of the report to be prepared regarding the applications to be made by individuals, to provide users with an application mechanism for fake or compromised accounts, and to take measures to protect user rights, as well as sanctions to be imposed in case of violation.
Obligations set out within the scope of the Recent Decision;
If the users' information is requested by judicial authorities, the social network provider has been obliged to provide this information.
The Turkish Criminal Code Law No. 5237 stipulates that upon the request of the public prosecutor or the court for the information necessary to reach the perpetrators who create or disseminate the internet content subject to the listed crimes, sexual abuse of children, publicly disseminating misleading information, disrupting the unity and territorial integrity of the state, crimes against the constitutional order and the functioning of this order, in investigations and prosecutions to be conducted within the scope of crimes against state secrets and espionage, the representative of the relevant social network provider in Turkey shall provide information to the judicial authorities.
It is regulated that in case of violation of the obligation to provide information to judicial authorities, the internet traffic bandwidth of the social network provider may be reduced by ninety percent.
Social network providers that violate the obligation to keep their users' data in Turkey may be imposed an administrative fine of up to three percent of their global turnover for the former calendar year.
The obligation to host the data in Turkey; Taking the necessary measures to ensure that the social network provider, which has more than one million daily accesses from Turkey, hosts the data of the users in Turkey, especially the basic user information, as well as the data related to the issues that may be notified by the Authority, in Turkey.
This obligation regarding data localization was defined in the Abrogated Decision. However, the sanctions to be imposed on the social network provider in case of failure to comply with this obligation were not regulated. On the other hand, the Recent Decision stipulates that in case of failure to fulfill this obligation, the social network provider will be imposed an administrative fine of up to three percent of its global turnover for the former calendar year.
It should be noted that the Recent Decision is still unclear as to how the rule on data localization will be applied. It is not clearly stated whether the social network provider complies with this rule if the data is hosted simultaneously in Turkey and abroad. Instead, it is stated in a broader wording that the social network provider must take the necessary measures to ensure that the data of users in Turkey is hosted in Turkey, but the necessary measures are not clearly and comprehensively stated.
Social network providers have been obliged to take necessary measures to protect user rights.
New obligations have been introduced for social network providers to protect user rights;
The social network provider must act impartially and equally among its users
Should provide users the option to update preferences for the recommended content and ability to limit the use of personal data
If any important security breaches occur related to user accounts, social network provider must notify the Authority and users within seventy-two hours after detection
Any updates that affect user rights made by social network provider should be accessible to users
Should include what parameters used while offering suggestions to users on its website
Should establish an application mechanism for attacked or impersonating accounts and resolve applications within a reasonable timeframe
With the Recent Decision, it can be said that important obligations have been imposed on social network providers in order to ensure users' rights to privacy and protection of personal data. The social network provider has been obliged to take the necessary measures and establish an application mechanism against the attacks on user accounts or impersonations that many users encounter frequently. Thus, users will be able to request the prevention of such interferences with their personal rights by applying to the social network provider.
Furthermore, it is seen that the services offered by social network providers include the obligations to inform users about the scope of use of their data and to provide them the choice of limiting the use of the data. When the obligations for the protection of user rights are examined, it can be considered that it is aimed to act in accordance with the obligations to ensure that the use of personal data is limited and proportionate for the purpose of use and to inform the data subjects in parallel with the Personal Data Protection Law No. 6698 ("PDPL").
Social network providers have been obliged to take the necessary measures to ensure providing child-specific segregated services.
Another important obligation that has been imposed on social network providers with the Recent Decision is to take necessary measures to ensure that the social network provider provides children-specific segregated services in content, advertisements and other services offered to users who can be identified as children.
In the Recent Decision, it has been stated that social network providers should take into account the following issues and are obliged to take the necessary measures in this direction;
Child’s age, the best interest of the child, protecting the physical, psychological, and emotional development of children, preventing the risks of child sexual abuse and commercial exploitation,
Ensuring a high level of privacy settings and minimalized data processing to protect the child's personal data,
Providing the matters such as the contract, user settings and data policies in a way that the child can be able to understand
It has been regulated that in case of breach of this obligation, the social network provider may be imposed an administrative fine of up to three percent of their global turnover in the former calendar year.
Social network providers with more than one million daily access in Turkey have been obliged to create ad libraries.
Creating an ad library is one of the obligations imposed by the recent decision. Hereunder, social network providers with more than one million daily access in Turkey are obliged to create an ad library and publish it on their websites.
It is regulated that the ad library will include the content of the advertisement, the type of advertisement, the advertiser, the period during which the advertisement remains on the air, the target audience of the advertisement, and the parameters used in determining the target audience, the number of people or groups reached by the advertisement.
It has been decided that the social network provider that fails to fulfill its obligation regarding the ad library will be imposed with an administrative fine of ten million Turkish Liras.
The qualifications should be included in the reports to be prepared pursuant to the obligation to report the applications made by individuals to the social network provider that have been determined. In addition, it has been imposed the obligation to publish these reports on the social network provider's website.
Social network providers with more than one million daily accesses from Turkey are obliged to respond positively or negatively within forty-eight hours at the latest to applications for the removal of content and blocking of access based on the allegation of violation of personal rights or privacy of private life in accordance with the provisions of Articles 9 and 9/A of the Law.
It has been regulated that an administrative fine of five million Turkish Liras will be imposed on the social network provider who fails to fulfill the obligation to respond to the applications made.
It has been preserved that the obligation of the social network provider to notify the Authority by the reports on the implementation of the decisions to remove the content and/or block access and the applications to be made in six-month periods has been preserved. In the meantime with the additional regulation, it has been decided that the reports to be prepared for the first six months of the year will be sent in July and the second six months will be sent in January.
Additional detailed regulations have also been introduced on the content of the reports to be submitted to the ICTA by the social network provider. This report will need to include information on the technical infrastructure for receiving and assessing applications, staff qualifications and administrative capacity to implement decisions, as well as categorical and statistical information on many different areas of the social network provider. Thus, it can be said that on one hand, it is aimed to activate the supervision mechanism by making the obligation to prepare reports specific for the social network provider, and on the other hand, it is aimed to ensure transparency by regulating the social network providers to publish these reports on their own websites.
It has been decided that an administrative fine of ten million Turkish Liras will be imposed on the social network provider that fails to fulfill its reporting obligation.
In the event of that failure to fulfill various obligations, the social network provider may be imposed an administrative fine of up to three percent of its global turnover.
The Recent Decision introduces supplementary obligations compared to the Abrogated Decision, and these obligations are grouped under the heading of various obligations, and any breach of these obligations is subject to administrative fines.
The social network providers may be imposed an administrative fine of up to three percent of their global turnover in the former calendar year in case of that if the social network provider fails to fulfill the obligations such as hosting the data in Turkey, providing child-specific segregated service, protecting user rights, protecting the security of life and property, informing the institution, and creating a crisis plan.
It should be stated that if administrative fines are not paid within the legal period more than once a year, the social network provider may be sanctioned with an advertising ban of up to six months. If an advertisement ban decision is issued, taxpayer individuals and legal entities resident in Turkey will be prohibited from placing new advertisements on the relevant social network provider.
The social network provider has been included in the scope of the Recent Decision regardless of whether its daily reach from Turkey is below one million.
When determining the scope of the Abrogated Decision, social network providers with less than one million daily accesses from Turkey were excluded from the scope and it was accepted that social network providers could submit a request to the ICTA regarding their exclusion from the scope. In the Recent Decision, the general provision regulating the exclusion of a social network provider based on the number of accesses has been removed. Instead, a normative structure has been adopted in which the social network provider is within the scope of the Recent Decision regardless of the number of daily accesses from Turkey, but is exceptionally excluded from the scope in cases particularly specified in the article.
Additional conditions have been stipulated for the appointment of a representative for foreign network providers with more than one million daily accesses and more than ten million daily accesses from Turkey.
The obligation of a foreign social network provider with more than one million daily accesses from Turkey to designate at least one authorized natural person or legal entity as its representative in Turkey continues. Together with the requirement that the natural person representative must be a Turkish citizen, the Recent Decision also introduces the requirement that the natural person representative must be a resident of Turkey.
If the representative to be determined by the social network provider is a legal entity, it is still obliged to be established in Turkey and to have acquired legal personality in accordance with Turkish legislation. However with the Recent Decision, in order for a foreign social network provider with more than ten million daily access from Turkey to designate a legal entity representative, the representative must be a branch established as a capital company or meet the additional conditions below mentioned;
a) The distinctive phrase of the title of the social network provider and the province of incorporation of the capital company also has a trade name that includes the trade name,
b) Wholly owned by the social network provider,
c) In the articles of the association should be within the organization of the social network provider and dependent on the social network provider,
ç) The capital stock to be at least one hundred million Turkish Liras,
d) In the articles of the association, it should be clearly stated that it has been made fully authorized and responsible for the technical, administrative, legal and financial matters.
It has been accepted to impose the sanctions listed below, respectively, on the social network provider that does not fulfill its obligations regarding the designation of a representative;
The social network provider that does not fulfill its obligations regarding the designation of a representative shall be notified by the Authority.
An administrative fine of ten million Turkish Liras shall be imposed on the social network provider who fails to fulfill its obligation to appoint a representative despite the notification.
A further administrative fine of thirty million Turkish Liras shall be imposed on the social network provider who fails to fulfill its obligation to appoint a representative following the notification of the administrative fine imposed.
Following the administrative fine imposed for the second time, the social network provider that fails to fulfill its obligation to appoint a representative will be prohibited from placing new advertisements by natural persons and legal entities who are taxpayers resident in Turkey.
If the obligations regarding the designation of a representative are not fulfilled following the advertising ban decision, an application may be made to the criminal courts of peace to reduce the internet traffic bandwidth of the social network provider by fifty percent.
In case that the obligations on the designation of a representative are not fulfilled following the implementation of the judge's decision on the acceptance of the application, an application may be made to reduce the internet traffic bandwidth of the social network provider by up to ninety percent.
Conclusion
With the advancement of technological developments and the increase in the interaction of the masses on the internet, especially through social media platforms, we see that the regulations specific to these platforms have developed and changed. In this regard, although the ICTA imposed certain obligations on social network providers with the Abrogated Decision, it was observed that these obligations were not regulated clearly enough and some of them did not even include sanctions.
With the Recent Decision; it is seen that the obligation to host user data in Turkey, which was not subject to sanctions in the Abrogated Decision, is subject to administrative sanctions, and the gaps regarding the content of the report to be prepared and published by the social network provider regarding user applications have been eliminated. However, the necessary measures required to be taken by the social network provider in relation to the hosting of user data in Turkey are not clearly stated in the Recent Decision, also. Lastly, many new obligations have been regulated for social network providers in the Recent Decision and these obligations are analyzed in our article.
Failure to fulfill these obligations imposed on social network providers by the Recent Decision may result in an administrative fine of up to thirty million Turkish Liras, an administrative fine of up to three percent of the social network provider's global turnover for the former calendar year, the prohibition of taxpayer natural persons and legal entities resident in Turkey from placing new advertisements on the relevant social network provider, and the restriction of the social network provider's internet traffic bandwidth by up to ninety percent. As these sanctions will lead to significant restrictions on the activities of social network providers and the imposition of high administrative fines, social network providers will be required to take the necessary measures under the Recent Decision.