EN 
TR 
The Turkish Medicines and Medical Devices Agency (“TITCK”) has published the Administrative Arrangement dated 21 May 2021 (“Administrative Arrangement”) between the European Commission and TITCK for the transfer of personal data and its unofficial Turkish translation.
Accordingly, it was stated that the purpose of the Administrative Arrangement is to ensure that the European Commission and TITCK transfer personal data in line with the requirements and applicable sectoral legislation. With this respect, the transfer of personal data as per the Administrative Arrangement is limited to transfers between the European Commission and TITCK, within the scope TITCK’s position as the regulator and authorized administration of medical devices and in vitro diagnostic devices, through European Database on Medical Devices (“EUDAMED”) or, if necessary, alternative administrative and technical regulations.
With the Administrative Arrangement, the European Commission and TITCK have committed to have appropriate measures for the processing of such personal data and to act in a manner consistent with this Administrative Arrangement, while fulfilling their respective regulatory powers and responsibilities. In addition, data subjects affected by the Administrative Arrangement were also mentioned and data subjects are specified as natural persons representing businesses, person/persons in charge of regulatory compliance, notified bodies, sponsors, researchers, legal representatives, expert panels, ethics committee members, national competent authorities, and EU Commission personnel. It also has been noted that the personal data categories processed are related to the identity and contact information of the data subjects, and in the case of clinical researchers, they also include data on professional qualifications.
Moreover, types of processing of personal data within the scope of the Administrative Arrangement include the collection and storage of personal data on the Data Center of the European Commission’s Directorate General of Informatics, but it is also possible for other types of processing to take place. It has been clarified that access to personal data would be available, primarily through a personalized user ID and password, or in limited circumstances certain personal data would be made publicly available. As determined by the Administrative Arrangement, personal data may be processed by TITCK to ensure that the authority uses its legal powers and operates following its obligations under the applicable sectoral legislation.
While it was stated that effective and enforceable rights and effective judicial reparations exist within the scope of applicable legal requirements for data subjects in the jurisdiction of the European Commission and TITCK, it also has been clarified that it will not replace any applicable legal requirements and the Administrative Arrangement does not create any legally binding obligations, grant any legally binding rights, or replace legal obligations in force in each jurisdiction. he European Commission and TITCK undertook to take measures to protect personal data through a combination of laws, regulations, and internal policies and procedures.
Personal data protection measures were also regulated with the Administrative Arrangement. In this context, in the statement for data processing, it was stipulated that personal data in EUDAMED is processed to ensure that all sectoral actors fulfill their obligations defined by the applicable sectoral laws and that the provisions of the European Commission and TITCK's applicable sectoral laws are implemented and enforced. Accordingly, personal data is to be processed specifically to allow the exchange of information regarding devices on the market and related economic operators, certain aspects of conformity assessment, notified bodies, certifications, clinical research, vigilance, and market surveillance and the processed data may only be transferred between the European Commission and TITCK for these purposes.
In terms of data quality and proportionality, the European Commission and TITCK would aim to transfer only personal data that is appropriate, relevant, and limited to what is necessary for the purposes for which they are transferred and for which they will be further processed. Regarding transparency, the European Commission would give general notification to data subjects about how and why it can process and transfer personal data, the type of organizations to which data can be transferred, and the rights granted to data subjects. In respect of security and privacy, the European Commission and TITCK would take appropriate measures to ensure that the processing of personal data complies with the provisions of the Administrative Arrangement and to protect the personal data transferred to them against accidental or unlawful access, destruction, loss, alteration, or unauthorized disclosure.
In the Administrative Arrangement, where measures regarding the rights of the data subjects were determined, there were also regulations regarding the further transfer and sharing of personal data. In this context, further transfer and sharing of personal data to third parties without the prior written approval of the transferring party is prohibited for both the European Commission and TITCK. In addition, the European Commission and TITCK would not retain personal data for longer than is necessary and appropriate for processing the data.
Finally, under the Administrative Arrangement, the European Commission and TITCK assured that, in their jurisdiction, a data subject who believes that a party has failed to comply with the measures set out in this Administrative Arrangement or that his/her data has been subject to a personal data breach, may seek compensation against that party.
Simge Kılıç, Esra Temur
