VERBIS Registration of Branches and Liaison Offices of Data Controllers That Are Not Located in Turkey
On October 7, 2019, the Turkish Personal Data Protection Authority ("the Authority") published a new decision summary on its website. The Authority’s decision w. no. 2019/225 covers the VERBIS registration (Data Controller Registry) requirement of branches and liaison offices of non-resident legal persons in Turkey. With this decision; it is decided that the branches of non-resident legal persons in Turkey shall be registered under certain conditions however the liaison offices do not have to register.
The Authority made the following assessments in its decision;
According to the Law on Protection of Personal Data (“the Law”) w. no. 6698; “The Data Controller is the natural or legal person who determines the purpose and means of processing personal data and is responsible for establishing and managing the data registry system.” Under the subparagraph 4 of Article 7 of the General Data Protection Regulation (“GDPR”); ‘the data controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. A more comprehensive definition has been given in GDPR and according to this definition; although the branches of commercial enterprises do not have legal personality, it is clear that they may be defined as data controllers.
In the subparagraph 3 of Article 40 of the Turkish Commercial Code (“TCC”) "The branches of the commercial enterprises whose centers are located in Turkey are registered to the Trade Registry and published." was regulated. According to the subparagraph 4 of the same article " The branches of the commercial enterprises whose centers are located abroad are registered like domestic commercial enterprises." According to these provisions, the branches of non-resident legal persons in Turkey are required to be registered in the trade registry like the domestic commercial enterprises.
Although the Law stipulates that it is required to be a natural or legal person in order to have the capacity of the data controller, such a requirement is not stipulated in the GDPR and the registration of the branches such as domestic commercial enterprises is required under Article 40 of the TCC. Therefore the Authority decided that the branches located in Turkey of non-resident legal persons are may be deemed data controllers.
According to the definition of the data controller under the Law; if the branches located in Turkey of non-resident legal persons determine- the purpose and means of processing personal data and is responsible for establishing and managing the data registry system, those branches must be considered as data controllers. In this case, the registration obligation arises under certain conditions to the branches located in Turkey. The branches of non-resident legal persons in Turkey with an annual number of employees of more than 50 or with the total annual financial balance sheet of more than TRY 25 million are obliged to with the VERBIS. If the conditions are fulfilled, both the non-resident legal person and the branch must be registered with the VERBIS. In this case, it is an important point that there will be two registrations in Turkey. The branches located in Turkey of a non-resident legal person that do not meet these requirements have no obligation to register.
On the other hand, liaison offices are evaluated differently In order to open a liaison office in Turkey; the legal persons of the companies should be established according to the foreign laws and these liaison offices should not engage in commercial activities in Turkey. Considering that they do not carry out commercial activities and do not have branch characteristics, it is decided that there is no obligation to register for liaison offices.
In light of all these explanations; it should be noted that the deadline for VERBIS registration is December 31, 2019. The administrative fine for not registering by the deadline is TRY 1.470.583 for this year. However, as of 2020, the penalty will be increased according to the new raise rates.
Comentarios