The Information Technologies and Communication Authority (“ITC Authority”) of Turkey has decided to postpone the implementation of the Regulation on the Processing Personal Data and Protection of Privacy in the Electronic Communications Sector (the “e-Privacy Regulation”) until July 2013. The Regulation that changes significantly data protection and is partially based on the European Union’s e-Privacy Directive and Data Retention Directive, was initially to enter into force on January 24, 2013.

More specific, the new e-Privacy Regulation includes severe new penalties for violations regarding illegal access to and processing of personal data, personal data security, data retention, international data transfer, and processing of location and traffic data. Violations could result in severe sanctions for telecommunications companies, including a fine of up to 3% of annual turnover and revocation of their licenses.

Furthermore, operators will be required to have a security policy on processing of personal data. The Regulation also introduces a five-year retention requirement for records of access to personal data. Moreover, in addition to the identity of the caller that is retained for one year, an extensive list of data such as the source of a communication and the time, duration, type, and location should also be retained.

Plus, when a risk threatening personal data security occurs the operator has to prevent the violation and if it is not able to do so it has to notify the ITC Authority. Finally, location data may only be processed to provide value-added communication services and only with the consent of the data subject.

Consequently, Turkish electronic communication companies should revise their data security measures and information risk management policies to comply with the regulation. They also have to ensure their data retention systems comply with the regulation’s requirements. The deadline to comply with these rules is July 24, 2013.