Information Technology Law

We are witnessing how the age of technology transforms and reshapes our daily lives, business models, and working methods. The science of law must closely follow these developments, which directly affect human life.

Recently, developments in financial technologies and the integration of crypto-assets into daily and commercial life have created a reality in which individuals and companies increasingly require professional legal support in this area. As the Solmaz Law and Consultancy team, we closely follow all national and international developments related to crypto-assets, which have gained a significant place globally. We conduct meticulous work and prepare detailed reports to provide timely, effective, and up-to-date legal support to our clients who need assistance with financial technologies and crypto-assets.

In particular, we offer high-quality and up-to-date legal services through our expert team in areas such as:

• Preparing detailed reports showing legal and commercial risk analyses starting from pre-establishment processes for crypto exchanges and wallet service providers
• Establishing legal infrastructure in line with current and anticipated developments in the sector
• Providing continuous legal consultancy services during the operational phase

Personal Data Protection Law

Personal data refers to any information that identifies an individual. This includes data such as name, surname, address, phone number, IP address, photo, and audio recordings. In today’s digital world, such data can be rapidly collected and processed, becoming vulnerable to malicious use. Therefore, protecting personal data has become one of the most crucial areas in modern legal systems, both in terms of private and criminal law.

Application Areas:

• Processing customer and employee data by companies
• Fulfilling the obligation to inform and obtaining explicit consent
• Cross-border data transfer
• Sanctions and complaint procedures in cases of data breaches

Conditions for Processing Personal Data

A person whose data is unlawfully processed may file a lawsuit for damages against the data controller based on tort liability under Article 6098 of the Turkish Code of Obligations. Under Articles 135 and following of the Turkish Penal Code (TPC), unlawful acquisition and sharing of personal data are criminalized and may result in imprisonment. Therefore, both civil and criminal consequences arise when personal data is obtained or used unlawfully.

According to the Law on the Protection of Personal Data (KVKK), personal data may be processed based on at least one of the following legal grounds:

• Obtaining explicit consent
• Clear provision by law
• Necessity for the formation or execution of a contract
• Fulfillment of a legal obligation
• Establishment, exercise, or protection of a right
• Publicly disclosed by the data subject
• Legitimate interest (provided that fundamental rights and freedoms are not violated)

Obligations in Data Processing:

• Preparation of an information notice
• Creation of a data inventory
• Obtaining explicit consent (if necessary)
• Responding to data subject applications (within 30 days)
• Registration with VERBIS (mandatory for certain data controllers)
• Obtaining permission or ensuring compliance for international data transfers

Cybercrimes and Criminal Law

Although not explicitly defined in the law, in practice, an “information system” is considered an electronic system that stores, processes, and transmits data. This includes personal computers, smartphones, web servers, social media accounts, and corporate networks.

Common offenses include unauthorized access, identity theft, fake profile creation, ransomware attacks, and data breaches. For the crime to occur, unauthorized access must be intentional; negligence or mistake does not qualify. Furthermore, if the person continues to remain in the system without permission after accessing it, the crime still applies.

Article 243 of the TPC stipulates increased penalties in certain cases:

• Data damage (paragraph 2): If data is deleted, altered, or damaged, the penalty is increased (6 months to 2 years imprisonment).
• Access to public systems (paragraph 3): Unauthorized access to government systems (e.g., municipal, SGK, or e-school systems) results in a penalty increase by half.
• Monitoring data traffic (paragraph 4): Monitoring network traffic without direct system entry (e.g., sniffing, packet capture) is also punishable (1 to 3 years imprisonment).

Crimes involving obstruction, disruption, deletion, or alteration of information systems:

• Disabling a system (e.g., server failure)
• Interrupting system operations (e.g., DDoS attacks)
• Deleting, altering, or encrypting data (e.g., ransomware attacks)
• Injecting malicious software or exfiltrating data
  Penalties are aggravated if these acts are committed against public institutions, banks, or financial systems.

Crimes Involving the Misuse of Bank or Credit Cards:
Article 245 of the TPC addresses fraud involving bank or credit cards, which are often tied to cybercrime, theft, and fraud. Crimes include:

• Using someone else’s card
• Producing or distributing counterfeit cards
• Gaining benefits through fake cards

Internet Law

Internet law encompasses legal frameworks to regulate and protect the online activities of individuals, companies, and public institutions. Key areas include:

Content Liability

• Legal compliance of content on websites, social media platforms, or forums
• Liability in cases of insults, defamation, or personal rights violations
• Obligations of content providers, hosts, and access providers

Access Blocking and Content Removal

• Blocking access under Law No. 5651
• Court or BTK (Information and Communication Technologies Authority) orders
• Catalog crimes: child abuse, obscenity, gambling, prostitution, etc.

Protection of Personal Rights

• Content removal in cases of privacy violations or defamation
• The right to be forgotten: removal of personal data from search engines
• Complaint mechanisms on social media

Copyright and Digital Publications

• Unauthorized use of online content (text, images, video)
• Legal protection on platforms like YouTube or Spotify under Intellectual Property Law
• Compliance with international practices like DMCA

E-Commerce and Digital Contracts

• Distance sales contracts on websites
• Right of withdrawal, return processes, and consumer complaints
• Commercial communication via email or SMS
• Legal compliance of e-commerce platforms
• Legal framework for digital contracts and payment systems

Artificial Intelligence, Blockchain, and Emerging Technologies

Blockchain is a decentralized and transparent data recording technology. Its applications include cryptocurrencies, smart contracts, and digital identity systems. Due to its anonymizing structure, it can be difficult to detect illegal content or transactions. Traditional internet law relies on a layered structure of content, host, and access providers, which is lacking in blockchain systems—making control difficult in cases of abuse.

To address this, the Ministry of Treasury and Finance and the Capital Markets Board (CMB) have issued several statements regarding crypto-assets, but a comprehensive Crypto-Assets Law has not yet been enacted.

Artificial intelligence (AI) simulates human-like reasoning, learning, and decision-making processes. It is used in chatbots, recommendation systems, facial recognition software, and automated content generators. Under the KVKK, AI systems must operate within personal data protection limits. Restrictions or interventions may be applied if the content involves criminal acts.

These technologies raise legal issues such as:

• Liability for damages caused by AI
• Validity of smart contracts
• Crypto fraud
• NFT and blockchain-based data processing activities
  They may lead to both civil and criminal consequences.

What is the Right to be Forgotten?

The right to be forgotten allows individuals to protect themselves against the continued accessibility of past events or personal data online. This right is critical for maintaining control over personal data and protecting reputation.

Key scenarios include:

• A past crime, although penalized, is still visible online
• An old news article negatively affects personal or professional life
• The desire to remove personal data once willingly shared