October 2024 – On 18 September 2024, Turkey’s Ministry of Trade published in the Official Gazette the Communiqué on Commercial Electronic Message Management System Integrators ("Communiqué"). The Communiqué introduces new procedures relating to the registration and management of consent for commercial electronic messages in Turkey’s Message Managing System (“MMS”)—a national database where various e-communications approvals are stored and managed. Among the changes introduced, the Communiqué defines business partners that assist service providers with registering approvals in the MMS, approval tracking, and management processes as “Integrators” and authorisation is required for service provision.
The Communiqué also states that those who have not obtained an integrator authorisation from the Ministry of Trade by March 2025 will be prohibited from arranging transactions relating to commercial electronic messages on behalf of a service provider.
Below we provide a summary of the main provisions of the Communiqué.
What was the practice before the Communiqué?
The Law on the Regulation of Electronic Commerce ("Law") and the Regulation on Commercial Communication and Commercial Electronic Messages ("Regulation") require service providers ("Service Provider") engaged in electronic commerce activities to obtain consent from recipients for commercial electronic messages sent to recipients' electronic communication addresses in order to promote and market their goods and services or to increase their recognition with content such as celebrations and greetings.
Pursuant to the Law and the Regulation, Service Providers wishing to send commercial electronic messages are also required to register with the MMS (in Turkish İleti Yönetim Sistemi). In practice, Service Providers have been able to carry out MMS processes through a business partner they authorised for MMS registration, approval tracking, and management processes.
What is the new scope introduced by the Communiqué?
The Communiqué regulates for the first time the service provider-business partnership model. Business partners now require authorisation from the Ministry of Trade to provide business partnership services, and service providers are prohibited from receiving services from unauthorised business partners. The Communiqué also regulates various provisions, in particular the conditions for authorisation and the obligations of integrators.
i. Integrator Authorisation
Article 4 of the Communiqué sets out various conditions for business partners to be authorised to act as an Integrator for the recording of commercial electronic messages in the MMS and the operation of the management system, including (i) company structure, (ii) suitability of managers, (iii) number and qualifications of employees to be employed, (iv) technical infrastructure, and (v) local database. Accordingly, the following qualifications (among others) must be met to become an Integrator:
- Company structure: It must be established as a joint-stock or limited liability company with a paid-up capital of at least one million Turkish liras.
- Manager eligibility: Company partners and managers must not have been convicted of “catalogue” crimes listed in the Communiqué, such as bribery, theft, fraud, forgery, and IT crimes.
- Employment structure: At least 15 personnel should be employed, including network and network security experts, database experts, system experts, quality systems experts and software development experts.
- Technical infrastructure: It must have a technical infrastructure with a redundant structure that can ensure business continuity 24/7 without any interruption and that has been penetration-tested by appropriate organisations.
- Local database: The information processing system, software, hardware and server infrastructure to be used in the Integrator service must be located in a database within the borders of the Republic of Turkey.
If the application submitted to İleti Yönetim Sistemi A.Ş. ("Authorised Institution") is deemed appropriate, the application will be sent to the Ministry of Trade within 30 days, and the Integrator authorisation will be granted by the Ministry of Trade. A contract will be concluded between the approved Integrator and the Authorised Institution.
ii. Integrator's Obligations
Article 13 of the Communiqué regulates the obligations of Integrators. Accordingly, an Integrator is obliged to:
- perform in accordance with the provisions of the Law, Regulation, Communiqué and the contract signed with the Authorised Institution;
- not act in a way that would be contrary to the interests of customers, Service Providers and the public and not cause damage;
- avoid transactions that may jeopardise the security of the MMS and/or damage the MMS, and to take technical and administrative measures to prevent unauthorised access and cyber-attacks;
- protect the personal data and trade secrets obtained within the scope of its services by taking adequate security measures;
- be jointly responsible with the Service Provider for the presentation of the customer’s approval and rejection information if the Integrator retains them.
- Integrator Authorisation Revocation and Sanctions
If an Integrator who fails to comply with its obligations or who loses any of the conditions that must be met to be authorised does not remedy the situation within the time limit set for remedying, its authorisation will be cancelled. In addition, the activities of Integrators will be subject to inspection by the Ministry of Trade, and the administrative fines provided for in the Law will be imposed on those who act in contravention of the legislation.
What will change after the Communiqué?
|
For Service Providers |
For Business Partners |
|
Service Providers that send commercial electronic messages to their customers and want to manage MMS processes with the business partnership model must work with Integrators authorised according to the Communiqué. |
In order to continue their services, companies providing business-partner services must obtain an Integrator authorisation from the Ministry of Trade until March 2025 at the latest, otherwise their authorisation to process commercial electronic messages on behalf of Service Providers will be revoked. |
Contact our team for detailed information about the new compliance process introduced by the Communiqué.