NEWSLETTER-2019-metin

280 NEWSLETTER 2019 be transferred without seeking the explicit consent of the data subject. If sufficient protection is not provided in the recipient country, the controllers in Turkey and in the related foreign country shall guaran- tee sufficient protection, in writing, and the Data Protection Board’s authorization shall be obtained. Through referring Article 28 of the Regulation on the Safety of Medicines 2 , the Guideline determines the retaining period of personal data as the relevant medicines’ license period to be a minimum of 10 years starting from the termination date of the medicine license. Conclusion Considering the large amount of sensitive data floating around in the healthcare sector, it is opined that the Guideline is an enlightening regulation. On the other hand, the regulation in the Guideline with regard to the processing of sensitive data without seeking the data subject’s explicit consent should be assessed in light of the principles that have been set forth in the Law. Accordingly, and as explained above, the explicit consent-free processing of personal data relating to health and sexual orientation may only be processed by any person or authorized public institutions and organizations that have the “confi- dentiality obligation” for the determined purposes in the same Article. Within that scope, it can be interpreted that the Guideline accepts the pharmaceutical companies as the ones who are under the “confi- dentiality obligation.” The Law, or the relevant secondary regulation, on the other hand, does not speak about the pharmaceutical companies’ status. Therefore, it is opined that the Data Protection Board’s opinion, or any secondary regulation that sheds light on the issue, would be beneficial. 2 http://www.mevzuat.gov.tr/Metin.Aspx?MevzuatKod=7.5.19578&MevzuatIlisk i=0&sourceXmlSearch=ila%C3%A7lar%C4%B1n%20g%C3%BCven (Access date: 16.09.2019).