The New Regulation Sets Out the Framework for the Authority and Social Network Providers – Interested Parties Should Scrutinise

Article by Ertuğrul Can Canbolat, Muhammed Safa Uygur, Su Başak Satır 

The Decision of the Information and Communication Technologies and Communication Board (“Board”) on Procedures and Principles Regarding Social Network Provider [1] (“Decision”) entered into force on 1 April. The Decision reiterates most of the provisions laid down in the previous Procedures and Principles Regarding Social Network Provider, which had entered into force in 2020 [2]. On the other hand, the new regulation provides for the details on additional rules, which were implemented with the amendments to the Law on the Regulation of Publications on the Internet and Combating Crimes Committed through these Publications (“Internet Law”) in 2022 [3]. In this respect, the Decision provides provisions and their respective details regarding the powers of the Information and Communication Technologies Authority (“Authority”) and the obligations of the social network providers and serves as an update to the previous legislation covering these matters. The social network providers which do not comply with the requirements brought by the Decision may face significant consequences. Hence, the Decision should be examined thoroughly and its provisions must be strictly adhered to.

What is Within the Scope of the Decision?

The Internet Law defines social network providers as natural or legal persons that enable users to create, view or share content such as text, image, sound, location on the internet for social interaction purposes. The Decision narrows this definition down through excluding (i) people who include content for social interaction only in a certain part of the broadcast on the Internet, and (ii) platforms where content for social interaction is provided as a secondary and ancillary service, such as personal websites, e-commerce websites and news websites from its scope.

Social Network Providers Are Obliged to Appoint Representatives

The Decision provides that the social network providers with more than one million daily access from Türkiye are obliged to designate at least one real or legal person as an authorized representative in Türkiye. Additionally, if a social network provider with access more than ten million from Türkiye is a legal entity, the representative must be a branch established as a stock corporation (“Designated Corporation”). Within this scope, it is set forth that:

- the Designated Corporation shall have a trade name that includes; (i) distinctive phrase of the title of the social network provider and (ii) the city in which the corporation was established and

- all of the Designated Corporation’s shares must be owned by the network provider,

- in the Articles of Association (“AoA”), it must be stated that the Designated Corporation is incorporated under and affiliated to the social network provider, and

- the capital amount of the Designated Corporation must be at least TRY 100 million and it must be clearly provided in the AoA that the representative has been fully authorized and deemed responsible for technical, administrative, legal and financial aspects by the social network provider.

The social network provider is obliged to notify the Authority with regard to the identity, title and communication information of the representative. Accordingly, if the representative is a real person the documents indicating that this person (i) is a Turkish citizen, and (ii) is a resident of Türkiye should be submitted to the Authority. However, if the representative is a legal person (i) its corporation contract, (ii) an example of the commercial registry gazette, (iii) other foundation documents, and (iv) the documents demonstrating the people authorized to represent and sign along with their contact information must be provided. In case of amendments to the aforementioned information and documents, the changes need to be notified to the Authority immediately and no longer than seventy-two hours.

If the notification obligations set forth are not complied with, the liable social network provider is notified. In the event that the obligation is not fulfilled within thirty days following the notification, an administrative fine of TRY 10,000,000; and in case the obligation is still not fulfilled within thirty days after the notification of the administrative fine, an administrative fine of TRY 30,000,000 will be imposed. Further, an advertisement ban will be imposed for failure to fulfil the obligations within thirty days following the notification of the administrative fine imposed for the second time. If the obligation is not fulfilled in three months subsequent to the notification of the advertisement ban decision, the internet bandwidth will be reduced by 50%. In the event that the obligations are not complied within thirty days after the notification of the implementation of bandwidth throttling decision, the bandwidth of the internet traffic will be throttled up to 90%. This rate cannot be determined to be lower than 50% taking into account the nature of the service provided.

The representative should (i) fulfil the declarations, notifications and requests sent by the Authority, the Access Providers Association or administrative authorities, (ii) respond to the applications to be made by individuals, (iii) performing the reporting obligation, (iv) fulfilling the obligations arising from the social network provider being a content or hosting provider, and (v) complying with other obligations under the Internet Law.

Notice and Take-Down Procedure

Pursuant to Article 9 of the Internet Law (titled withdrawal of the content and blocking of access), the natural and legal persons who allege that their personal rights were violated can appeal to the social network provider (or in case it cannot be reached to the hosting service provider) and demand that the content to be removed [4]. Moreover, it is set forth in Article 9/A, titled blocking access to content due to the right to privacy, of the Internet Law the persons claiming that their right to privacy were hindered can directly apply to the Authority for the prevention of access to the content. In accordance with the Decision the social network providers with more than one million access from Türkiye are obliged to respond to these requests within forty-eight hours following the application.

Within this scope, in order for the applications being made easily, it is stipulated in the Decision that the social network providers will provide the opportunity for the application to be made in Turkish. The answers to the applications made in Turkish also are required to be in Turkish. Moreover, if the application is rejected the social network provider should provide a reason. In case this obligation is not fulfilled a fine amounting to TRY 5,000,000 will be imposed on the social network provider. The Authority makes its determination regarding the imposition of a fine based on whether (i) the necessary systems have been established to fulfil the obligation to answer, (ii) negative answers are regularly given to certain persons or regulations, (iii) the deadlines in the Internet Law are systemically violated, and (iv) negative answers are justified.

Promoting Transparency, Equal Treatment and Accountability

The social network providers with access of more than one million from Türkiye should form an advertisement library for the purpose of enhancing transparency [5]. In this library, matters such as the content, type, period of air, target group of the advertisement, the advertiser and the amount of people or groups the advertisement reached should be provided. In the event of non-compliance with this obligation a fine of TRY 10,000,000 will be imposed on the social network provider.

Additionally, for the protection of user rights, social network provider shall treat the users equally and objectively. The social network provider should take measures to allow users to update preferences for the content it recommends and limit the use of personal data. In the event of serious security breaches that directly or indirectly affect users in Türkiye, the social network provider must inform users accessing the platform from Türkiye and the Authority within 72 hours. It should also ensure that users can easily access updates affecting user rights in the services it offers. It is essential that clear, understandable and easily accessible information, about the parameters it will use when providing recommendations to its users, is provided on its website. Moreover, the social network provider should establish a clear, comprehensible and easily accessible complaint channel in Turkish in the case of hacked and impersonated accounts and should finalise users' applications within a reasonable period of time. Lastly, the social network provider shall comply with other regulations on user rights to be issued by the Authority. In case the social network provider does not fulfil these obligations a punishment of at most 3% of the global turnover of the social network producer may be imposed.

Further, the social network provider is under the obligation to prepare semi-annual reports and submit them to the Authority. The report should include (i) Information on the technical infrastructure for the implementation of decisions to remove content and/or block access, and for receiving or evaluating applications from individuals, and on the qualifications and administrative capacity of personnel to implement the decisions, (ii) information on the duration and manner of implementation of decisions and their geographical scope, (iii) categorical and statistical information on the process of handling applications, such as the number and type of applications made by individuals, their positive or negative assessment, the reasons for the unfavourable response, the duration of the response, (iv) categorical and statistical information on decisions of judicial and administrative authorities, such as the competent authority issuing and sending the decision, the manner of sending the decision, the legislative provision on which the decision is based, the timeframes for the execution of the decision, (v) categorical and statistical information on the activities carried out within the scope of self-audit, (vi) information on measures taken to treat users equally and impartially, (vii) information on measures taken to provide users with the option to update their preferences for recommended content and limit the use of their personal data, (viii) information on title tags, algorithms for content that is promoted or reduced access, and information on transparency policies, (ix) information regarding advertisement policies, (x) information concerning the formation of an advertisement library and its publication in the website, and (xi) information on measures taken to prevent the publication of content and title tags related to offences under the Internet Law.

Within this scope, the social network provider should act in accordance with the principle of accountability, establish transparency and provide any information/document to the Authority when requested. In case the reporting obligation is not fulfilled a fine amounting to TRY 10,000,000 is imposed on the social network provider.

Providing Information, Data Localisation and Child Protection

In the event that information is requested on certain matters covered under the Penal Code of Türkiye (“Penal Code”) [6] by the public prosecutor or the court to reach the wrongdoer, the representative of the social network provider shall submit the necessary information to the authorities. A failure to do so may result in the public prosecutor applying to the Ankara Magistrates Court for throttling the bandwidth up to 90%. In case it is decided by the court to throttle the bandwidth this decision is immediately sent to the Authority for it to inform the social network provider. The access provider will implement the decision within four hours after it has been informed to the social network provider.

Moreover, the social network provider with access more than one million from Türkiye should take the measures ensuring that the data of the users in Türkiye is stored in Türkiye. In this regard, the main user information and matters which can be notified by the Authority are prioritized.

Additionally, the social network providers are obliged to create an application mechanism for the title tags or highlighted content to remove them with a warning system. In this regard, they are liable to inform the Authority about the mechanism they have established or they are operating within the reporting periods. In case a social network provider does not remove a content which it has provided an environment for the crime to be committed through the title tags and highlighted content in four hours following the notification of the illegal content it will be held fully responsible for the concerned content.

Further, social network providers shall share with the authorised law enforcement unit in the event that they found content which puts the life of persons into danger and that the delay of this content would be inconvenient. The Authority can also request explanations on the organisational structure, information systems, algorithms data processing mechanisms and commercial attitude from the social network provider regarding the compliance to the Internet Law. The social network provider is obliged to submit the information/documents requested by the Authority at the latest in three months following the request’s notification. Moreover, the social network provider is required to form a crisis plan for the situations affecting public health and safety.

Lastly, the social network provider shall take the necessary measures to provide separate services to children. Within this scope, the age, the best interest, protecting the physical, psychological and emotional development, preventing the molestation and commercial exploitation, ensuring a high level of confidentiality settings and a minimum level of data processing in the protection of personal data of the child and presenting matters such as the contract, user setting and data policies in a way that the child can understand are the matters which should be considered.

In case of non-compliance with the provisions provided under this section concerning data localisation, providing separate services for children, submitting information to the Authority and formation of a crisis plan a punishment of at most 3% of the global turnover of the social network producer may be imposed.

Extended Powers of the Authority

In accordance with the Internet Law, it is decided to remove the content and/or block access to the publications made on the Internet and for which there is sufficient grounds for suspicion that the content constitutes the certain offences [7]. In this regard, the decision of the Authority to remove the content and/or block access to the publications made on the Internet should be complied within four hours of its notification to the social network provider. Accordingly, it is reiterated that if this obligation is not carried out by the social network provider it may be decided to prohibit the social network provider from advertising. In case it is not complied with this decision a fine varying between TRY 10,000 and TRY 100,000 can be imposed on the social network provider. Moreover, it may be applied to the Magistrates Court by the President of the Authority to throttle the bandwidth of the internet traffic by 50%. In the event of non-compliance with the obligation thirty days after the notification of the throttling of bandwidth of the Internet the President of the Authority may apply to the Magistrates Court and request throttling the bandwidth of the internet traffic by 90%.

The Authority in order to ensure the compliance of the social network providers may carry out on the spot inspections at their every facility.

Conclusion

The Decisions brings forth the most up to date provisions covering the procedures and principles which should strictly be adhered to by the social network providers as well as the fines which will/may be imposed in case of non-compliance. Consequently, considering that the fines may have substantial consequences for the social network providers it is of utmost importance to closely monitor the compliance with the obligations set forth by the Decision.

Published by Lexology on April 14, 2023

 

1 The Decision dated 28 March 2023 and numbered 2023/DK-İD/119 which can be accessed from the link: https://www.resmigazete.gov.tr/eskiler/2023/04/20230401-13.pdf 

2 The Decision dated 29 September 2020 and numbered 2020/DK-İD/274 which can be accessed from the link: https://www.btk.gov.tr/uploads/boarddecisions/sosyal-ag-saglayici-hakkinda-usul-ve-esaslar/274-2020-web.pdf

3 Please see: https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=5651&MevzuatTur=1&MevzuatTertip=5

4 The natural or legal persons who allege that their personal rights were violated can also directly appeal to judge of the Magistrates Court for the content to be removed or access to be prevented.

5 In the Additional Article 4 paragraph 4 of the Internet Law the establishment of an advertisement library is also stipulated. However, the Decision regulates to which social network providers it applies to in detail.

6 Child molestation (Article 103 of the Penal Code), disseminating misleading information to the public (Article 217/A), disrupting the unity and territorial integrity of the state (Article 302 of the Penal Code), offences against the constitutional order and its functioning (Articles 309, 311, 312, 313, 314, 315 and 316 of the Penal Code), offences against state secrets and espionage (Articles 328, 329, 330, 331, 333, 334, 334, 335, 336, and 337 of the Penal Code).

7 The offences are listed under Article 8 paragraph 1, which is titled as execution of content removal and access blocking decisions of the Internet Law.