Accreditation and certification system for the protection of personal data in the light of GDPR

The evolution of personal data, both in terms of its types and methods and volumes of processing, parallel to the advancement of technology, has brought to the forefront the necessity for its protection not only through provisions safeguarding personality rights or penal provisions but also through a unique mechanism framework. Simultaneously, due to technological advancements, this situation has necessitated a higher level of protection for personal data, prompting the consideration of personal data as rights protected within the scope of constitutional law. In Turkey, the right to the protection of personal data was regulated as a constitutional right through an amendment to Article 20 of the Constitution. With the enactment of Law No. 6698 on the Protection of Personal Data in 2016, a personal data protection law compatible with EU and global regulations was adopted. During the period of Directive 95/46/EC in the EU, the "e-privacy seals" practices were observed, where data controllers were subjected to a sort of certification, indicating compliance of data processing processes with existing legal regulations. Following the enforcement of the GDPR, in addition to the accreditation and certification provisions of the GDPR, guidelines have been published at the EU level to provide explanations and further clarifications to these regulations in the context of personal data protection. Subsequently, in the EU, a system of accreditation and certification for the protection of personal data, under the name "EUROPRIVACY," has been newly established.