Analysis of KVKK Data Breach Notifications: Expanding Risk Areas and Legal Sanctions

Introduction: We have collectively reviewed the data breach notifications recently published by the Turkish Data Protection Authority (“the Authority”), which now number more than one hundred. When these announcements are examined as a whole, it is apparent that data security risk is shaped largely through the supply chain and external service providers.

How Did the Breaches Occur?

Many of the breaches (approximately 70%) occurred not in the data controllers’ own systems, but in the systems of the data processors/suppliers from which they receive services. In a large number of announcements, the access resulted from a security vulnerability in a third-party software component (library) in use. Furthermore, while ransomware attacks were almost non-existent earlier in the period, they increased markedly toward the end of the period; 6 of the 17 announcements in one publication batch were ransomware-related and mainly affected companies providing software/call center services as well as a university.

In Which Sectors Are the Announcements Concentrated?

The concentration lies in e-commerce and retail, predominantly consumer-facing. Textile/apparel and store retail lead in particular, followed by the cosmetics-health and food sectors. With the ransomware attacks in October, sectors such as software/IT and public sector-education have also been affected.

Which Data Were Affected?

The affected data are generally basic contact and membership information (full name, email, address, telephone and login/password information). Data such as location, legal transaction, risk management, pure financial data and identity number data have been affected to a lesser extent. In ransomware-related incidents, on the other hand, data such as employee/HR (experience and performance) data, CVs and call recordings stand out. In most of the announcements, the number of affected individuals has not yet been finalized.

Data breach notifications mostly concern ordinary personal data; however, 9 announcements explicitly stated that special categories of personal data within the scope of Article 6 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) had also been affected. As employee personnel files were affected, health data and data relating to criminal convictions and related security measures (criminal records) were subject to the breach, and in the case of one construction company, biometric and genetic data were also involved. At companies providing services to visually impaired members, disability data was affected due to the call center support provided to these members. At a visa/exchange program company, criminal record and security investigation documents obtained within the scope of the program were subject to the breach.

Sample Cases by Sector:

• A cosmetics retail chain: A third-party software vulnerability on a supplier’s server was exploited. More than 6.2 million individuals were affected, making it the largest breach of the period.

• A textile/apparel e-commerce company: Approximately 95,000 customers were affected due to the same type of supplier-originated vulnerability.

• A footwear retailer: Approximately 354,000 individuals were affected due to a breach originating from a data processor.

• A construction company: Health, biometric and genetic data were subject to the breach, together with employee HR data.

• A group of companies providing call center/software services: As a result of a ransomware attack, employee HR/performance data, job applicants’ CVs and call recordings were affected.

• An international design/software platform: Through access via a third-party tool, data concerning hundreds of organizations in Türkiye were affected.

The Scope of the Risk Is Not Limited to E-commerce Companies

Although e-commerce and retail companies feature prominently in the breach announcements, it would not be accurate to conclude that the resulting risk is specific to these sectors alone. It should not be overlooked that even companies in the construction, manufacturing or services sectors that consider themselves not to process customer data do process HR data relating to the staff they employ.

As in the construction company example above, special categories of personal data such as health data, criminal records and even biometric and genetic data may also be processed. Therefore, the risk of legal liability and administrative sanctions that may arise from a data breach concerns all data controllers, regardless of sector.

For organizations operating in e-commerce and online, the picture is arguably even clearer. The fact that the majority of the breaches occurred not in the organization’s own system, but in the external infrastructure from which it receives services, does not relieve the data controller of its responsibility; on the contrary, it brings the obligation to supervise data processors and suppliers even further to the fore.

Statistical Data and Tables

The tables below contain a statistical breakdown of the recent data breach notifications on which the above assessment is based.

(Since more than one data subject group may be specified in a single announcement, the rates add up to more than 100%. In 13 announcements, the affected group was not explicitly specified. In the table, the groups are presented using the terms used in the announcements (customer, user, member and subscriber separately); all of these are consumer-facing groups and, taken together, they show that the breaches predominantly affect customer/consumer data. The employee group, on the other hand, stands out mostly in breaches arising from ransomware and compromised personnel files.)

(Based on 109 announcements; a single announcement may involve more than one data type. The rates are approximate, since some announcements list the data fields individually while others refer to the data categories used under the KVKK — identity, contact, employment, etc.)

Recommended Measures

1.   Creating a data processor inventory: It should be determined which external providers, software and infrastructure are used, and by whom the data are processed.

2.   Reviewing supplier/sub-processor contracts: It should be examined whether the contracts contain commitments regarding technical and organizational measures under Article 12 of the KVKK, sub-processor approval, breach notification timelines and audit rights.

3. Requesting annual security audits/penetration tests: Regular independent security reports should be requested from suppliers, and this obligation should be set out in the contract.

4.   Third-party component and patch management: An inventory of the software libraries in use should be prepared, and their update status should be monitored regularly.

5.   Resilience against ransomware: Offline/immutable backups, network segmentation and an incident response plan should be put in place.

6.   Applying the special category data regime: Employers that keep health/criminal record data in personnel files should apply a separate security and retention regime in line with Article 6 of the KVKK and the Turkish Data Protection Board’s decisions requiring additional safeguards.

Conclusion: Recent data breaches demonstrate that data security is no longer solely an internal matter, and that a data controller may also be held responsible for the security level of the data processors and suppliers from which it receives services. Accordingly, it is important that compliance efforts are not limited to isolated measures but are carried out with a continuous and holistic approach that also encompasses the supply chain. Considering that we have entered a period in which a data breach is no longer a mere possibility and the question is rather when it will occur, we consider that the resources allocated to preventive measures will remain limited in comparison with the legal, financial and reputational consequences of a potential breach.