The Communiqué, which has been adopted in accordance with Article 22(1)(e) of the Personal Data Protection Law numbered 6698[1] and Articles 7(1)(g)-(ı) and 18(1)(a) of the Regulation on the Organisation of the Personal Data Protection Authority[2], essentially regulates (i) the role of data protection officers; (ii) the conditions with which personnel certification institutions must comply in order to be authorised to grant accreditation; and (iii) the Certificate Tracking and Verification Information System (“SERTABIS”).

Accreditation Process

Under the European Union legislation, data protection officers are independent actors who are responsible for data controllers’ compliance with the personal data protection legislation. They report directly to senior management and are equipped with significant authority.  The Communiqué is in line with the European Union legislation.

As per the Communiqué, personnel certification institutions accredited in accordance with the (TS) EN ISO/IEC 17024 standard and authorised by the Authority will be able to issue certificates to applicants participating in training programs, which are to be conducted in accordance with the training principles and procedures to be announced in detail by the Authority at a later stage. Those applicants who obtain a certificate and succeed in the exams of  the respective personnel certification institution will obtain the title of “data protection officer”. No other technical or professional pre-qualification conditions are set forth other than participating in the relevant training program and successfully completing the exams at the end of such program.

Main Principles Regarding Data Protection Officers

Data protection officers will be deemed to have gained sufficient personal data protection knowledge within the scope of their training and the accreditation will be valid for a period of 4 years. At the end of this period, however, data protection officers are required to retake the exams and hence renew their accreditation.

SERTABIS

The Communiqué also establishes the SERTABIS in order to ensure that the certification process is carried out in an impartial, transparent and effective manner.  

Conclusion

The Communiqué establishes principles for (i) the training of persons on personal data protection to become data protection officers; (ii) experts to take solid action towards the enhancement of data security;  and (iii) transparency and public confidence with the organisation of the SERTABIS. Finally, a point worth noting is that working with a data protection officer will however not release data controllers or data processors from liability to comply with the relevant legislation.