The Personal Data Protection Authority issued a public announcement on April 7, Personal Data Protection Day. The announcement mentions the place of "Distance Education Platforms", which we are all familiar with, in KVKK. It is mentioned that students' personal data such as names and surnames and special personal data such as voice and image are processed on Distance Education Platforms and that this processing must be done in accordance with the law, even though we are going through an extraordinary period. In the announcement, it was underlined that it should not be forgotten that transfers that do not comply with Article 9 of the Law are against the Law.
Well, KVKK 9. What are the sub-articles of the article' in the context of this subject?
1) Personal data cannot be transferred abroad without the explicit consent of the person concerned.
2) Personal data, the existence of one of the conditions specified in the second paragraph of article 5 and paragraph 3 of article 6, and in the foreign country to which the personal data will be transferred;
a) Availability of adequate protection,
b) In the absence of adequate protection; It can be transferred abroad without seeking the explicit consent of the data subject, provided that the data controllers in Turkey and in the relevant foreign country undertake in writing to an adequate protection and the permission of the Board is available.
The main issue mentioned here is that most of the data centers of the platforms used are abroad, and therefore it should not be forgotten that the data must be transferred in accordance with the articles of transferring the data abroad. We should not forget that the data controller should also control the purposes for which the transferred data is stored and the methods by which it is protected.
Announcement link: https://kvkk.gov.tr/Icerik/6723/Uzaktan-Egitim-Platformlari-Hakkinda-Kamuoyu-Duyurusu
