The Cybersecurity Law Proposal, submitted to the Turkish Grand National Assembly (TBMM) on January 10, 2025, addresses a highly significant issue and grants public authorities extensive powers to intervene in individual rights. However, despite its far-reaching implications, the proposal was rushed through the National Defense Committee and approved on January 15 without allowing for public debate. Additionally, no prior announcement was made before its submission to Parliament.Legislation concerning both national security and individual data protection must undergo thorough public discussion to ensure a balanced and rights-respecting framework. Any legal regulation in this field should be in line with technological advancements, respect human rights, meet national security requirements, and include safeguards against the abuse of power. This necessitates extensive deliberation among political parties, civil society organizations, experts, and other stakeholders. However, not only was this proposal not subjected to such a preparatory process, but it also appears to have been pushed toward legislation without allowing for proper debate in Parliament.Although the proposal was referred to the Justice Committee, the Plan and Budget Committee, and the Industry, Trade, Energy, Natural Resources, Information, and Technology Committee, in addition to the National Defense Committee, none of these secondary committees examined it or issued a report. This legislative approach is evidently neither democratic nor participatory.The stated purpose of the law is to establish a comprehensive legal framework for cybersecurity and to define related policies and strategies through the creation of a Cybersecurity Council. Accordingly, the law establishes a Cybersecurity Council and regulates the duties and powers of the Cybersecurity Directorate (SGB), which was previously established by Presidential Decree.Notably, Article 6 of the proposal grants the Directorate the authority to request and access all types of information and data within its jurisdiction. This data may include not only personal information, such as health and financial records but also logs of websites visited and digital content viewed or read by individuals. The proposal stipulates that the information, documents, data, and records obtained by the Directorate may be used for up to two years before being destroyed. However, the proposal does not include any safeguards to prevent the unnecessary collection, processing, or transfer of data, nor does it contain provisions to prevent abuse of such powers.Additionally, the Directorate is granted the power to collect, store, analyze, and prepare reports based on log records from information systems and to share these reports with relevant institutions and organizations. The only safeguard provided in the law regarding data protection is a requirement that the data be deleted once its purpose has been fulfilled. However, the law does not establish any oversight mechanisms to ensure compliance with the deletion requirement, nor does it provide any safeguards against the misuse of collected data.Additionally, the proposal mandates that public institutions, organizations, and critical infrastructure procure cybersecurity products, systems, and services only from cybersecurity experts and companies that have been authorized and certified by the Cybersecurity Directorate. Ensuring that this authorization and certification process is conducted objectively and impartially is of vital importance. Unfortunately, the law does not include any safeguards to guarantee such impartiality.Furthermore, Article 9 of the proposal grants the President of the Directorate the authority to order searches, data copying, and seizures in private residences, workplaces, and non-public spaces in cases where delays might be deemed harmful. These actions are subject to subsequent judicial approval, with a requirement that the collected data be destroyed if a judge refuses to authorize the operation. However, considering the state of the judiciary in general, and particularly the Criminal Peace Judgeships, the effectiveness of this safeguard is highly questionable. Moreover, when it comes to public institutions, even judicial approval is not required for searches and seizures. Such provisions, which grant authorities the power to intervene in individuals' private lives, personal data, and homes, clearly violate constitutional rights and are unquestionably unconstitutional.The proposal also introduces new criminal offenses. In this context, individuals who fail to provide the information requested by the Directorate, carry out cyberattacks, violate confidentiality obligations, or trade data obtained through cyber leaks will be subject to criminal penalties. Additionally, in a particularly problematic provision, the law criminalizes activities that aim to create the perception of a cyber leak, even if no actual data breach has occurred, thereby targeting individuals or institutions. While the phrase "creating a perception" was later amended in the Committee to "creating content as if a data breach had occurred," it is evident that this provision poses a serious threat to press freedom.Given these flaws, the proposal should be withdrawn and replaced with a law that is developed through a comprehensive participatory process and includes adequate safeguards against violations of fundamental rights.

The Freedom Observer

The Cybersecurity Law Proposal, submitted to the Turkish Grand National Assembly (TBMM) on January 10, 2025, addresses a highly significant issue and grants public authorities extensive powers to intervene in individual rights. However, despite its far-reaching implications, the proposal was rushed through the National Defense Committee and approved on January 15 without allowing for public debate. Additionally, no prior announcement was made before its submission to Parliament.

framew ile ilgili hikayeler