76 NEWSLETTER 2021 Customer Secret As per Article 73/3 of the Law, data and information belonging to natural persons or legal entities collected in the course of banking activities and transactions after the establishment of customer relations with banks become, and are classified as, customer secrets. The Regulation expands this definition and sets forth that any information showing that a real or legal person customer is a customer of the bank, is also deemed as customer secrets. It further regulates that even if a customer relationship has not been established, obtaining and learning customer secrets held by another bank will be considered within the scope of the confidentiality obligation. Moreover, pursuant to the Regulation, data that exists prior to the customer relationship with the banks, and which is not held by another bank as a customer secret, becomes a customer secret if it is processed in a way that identifies such person as a bank customer on its own, or when processed together with the customer secret data, which is formed after a bank-customer relationship is established. It is also seen that the Regulation includes the definition of pseudonymization and data processing in parallel with Personal Data Protection Law No.6698 (“Law No.6698”). Article 3/1(i) defines the pseudonymization by considering the banking activities and the characteristics of the finance sector as follows: “Processing of customer-related data in a manner that cannot be linked with the customer, provided that technical and administrative measures are taken in order not to link the customer with an identified or identifiable real/legal person and without combining it with other data stored in a different platform.” Confidentiality Obligation The confidentiality obligation was regulated in parallel with the banking legislation as the following: Those who, by virtue of their positions or in the course of performance of their duties, have access to a bank secret or customer secret are not permitted to disclose such confidential information to any person or entity other than the authorities explicitly authorized by law. This obligation shall also be applicable in
RkJQdWJsaXNoZXIy MjUzNjE=