NEWSLETTER-2017

318 NEWSLETTER 2017 The GDPR replaces the Directive 95/46/EC, a comparison of which is provided in my previous article with the then-in force cor- responding regulations under Turkish law 3 . This article aims to sum- marize the significant reforms introduced by the GDPR to EU data protection rules along with its applicability outside of the EU. Significant Reforms Introduced by the GDPR Primarily, the GDPR aims to reinforce the right to protection of personal data as foreseen under Art. 8(1) of the Charter of Fundamen- tal Rights of the EU and Art. 16(1) of the Treaty on the Functioning of the European Union. In this regard, the common ground of the re- forms introduced by the GDPR is that they are aimed at ensuring that the natural persons practice greater control over their personal data. Although not constitute an exhaustive list of all the reforms brought by the GDPR, some of the concepts and regulations adopted therein to ensure such greater control are summarized below: • Consent . The main criterion for processing personal data has been determined under Art. 6(1) of the GDPR as the consent of the data subject, the conditions of which are strengthened by the GDPR. Further, the Preamble of the GDPR 4 states that consent should be given by a clear affirmative act estab- lishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral state- ment. The exceptions for the consent requirement are laid down under Art. 6 of the GDPR. • Right to be Forgotten . Pursuant toArt. 17 of the GDPR, data subject has the right to be forgotten, which is defined as the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the data controller shall have the obligation to erase personal data 3 Uludere, Eda. Personal Data Protection under Turkish and European Legislation, Erdem&Erdem Newsletter, December 2015. 4 Please see, the Preamble of the GDPR, § 32.