General context, key principles and hot topics
1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.
There have been several criminal investigations in public health or education institutions regarding bribery and misconduct. However, none of them can be identified as high-profile corporate investigations. Instead, the focus during the past year regarding compliance-related issues appears to have been on administrative and regulatory investigations.
Very recently, the Turkish Competition Board decided to launch an investigation into Audi, Porsche, Volkswagen, Mercedes-Benz and BMW on grounds concerning the maximum speed limits for the radar speed control system, roof hatches, elimination of use and postponement of release of gasoline particulate filters in the scope of environmental collaboration, sensitive information on selective catalytic reduction technology and AdBlue tanks. The Turkish Competition Board aims to determine whether the alleged claims have impacts in Turkey or not.
The Board has also initiated another investigation on 29 businesses, including chain markets, to determine whether the companies breached any provisions of Law No. 4054 on Protection of Competition when setting the retail prices of certain products. Significant mark-ups and several flaws in the supply chains during the covid-19 pandemic are judged to have triggered the relevant investigation.
In addition, the Turkish Data Protection Board has conducted several investigations that are noteworthy. Among others, the highest profile investigation concerned Amazon Turkey. The Board has reported that certain practices by Amazon Turkey breached certain obligations set out under Law No. 6698 on the Protection of Personal Data (DPA). Consequently, the Board conducted an investigation and imposed administrative fines on Amazon Turkey of 1.1 million Turkish lira for failing to comply with the personal data security requirements and of 100,000 Turkish lira for failing to comply with the information obligation requirements.
2 Outline the legal framework for corporate liability in your country.
Under Turkish law, corporations cannot be held criminally liable. When a crime is committed for the benefit of a legal person by the participation of its representatives or authorised bodies, the Turkish Criminal Code (CC) provides for security measures to be imposed on that legal person. Those measures are listed as the cancellation of business licences granted by a public authority, and the seizure of goods that are used, allocated for or gained as a result of the commission of crime. In addition, when certain crimes (e.g., fraud, collusive tendering, bribery, money laundering) are committed by representatives or authorised bodies or by third persons who perform a task within the framework of a legal person’s field of activity, administrative fines are also imposed on the legal person, as prescribed by Article 43 of the Law on Misdemeanours.
3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?
There are no special authorities relating to the prosecution of corporations. When a crime is committed by a corporation, public prosecutors and criminal courts prosecute representatives or members of authorised bodies of the corporation. In addition, pursuant to Law No. 5549 on Prevention of Laundering Proceeds of Crime, the Financial Crimes Investigation Board is authorised to convey to the public prosecutor’s office any case in which there is serious suspicion that a money laundering or terrorism financing offence has been committed.
4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?
Having an impression that a crime has been committed is sufficient for the public prosecutor to trigger an investigation. According to Article 160 of the Criminal Procedure Code (CPC), the public prosecutor would start an investigation as soon as he or she becomes aware of any impression of a crime being committed, by any means (e.g., the reporting of a crime).
5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?
Whereas Law No. 2577 on Administrative Procedure provides for application to a superior administrative body or the filing of a cancellation action as legal remedies to challenge the lawfulness or scope of an administrative action, the CPC provides an objection procedure before the issuing authority or its superior. The procedure to be followed when filing these applications and the time limits within which they should be made are set out clearly by these laws. Similar procedures are also set out by various special laws, such as the Law on Capital Markets and the Law on Misdemeanours.
6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?
Although it is not an agreement technically, there is an effective remorse mechanism (a type of leniency) under the CC that provides for either a reduction in the punishment or full immunity. This mechanism applies for certain crimes only as prescribed by the CC; these include bribery and money laundering. In respect of bribery, if either the perpetrator, participant, intermediary or accessory to a crime reports the same to the authorities before the law enforcement bodies become aware of it, that person will not be subject to any punishment for bribery. In respect of money laundering, there will be no punishment for a person who helps the law enforcement bodies to seize the assets that are the subject of a crime or reports their location before the commencement of criminal proceedings.
There are some reconciliation mechanisms that apply with regard to tax and customs-related administrative investigations and sanctions. These mechanisms do not provide for complete immunity, but do provide for considerable decreases in the fines and penalties imposed.
7 What are the top priorities for your country’s law enforcement authorities?
In parallel with our response to question 1, except for several lower-profile criminal investigations for bribery and corporate misconduct in the healthcare and education industries, data compliance and competition-related administrative and regulatory investigations have taken the lead during the past year.
8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?
Unlike regulated sectors (e.g., insurance, banking, pharmaceuticals), no specific importance is placed on a corporation having an effective compliance programme at the desired level as it is still a growing area in Turkey. That said, this does not set aside the benefits of having an effective compliance programme. Although the authorities do not attach importance to these programmes at desired levels, having an effective compliance programme may positively effect the discretion-based evaluations of the authorities as it would indicate that the corporation under investigation makes some effort to run appropriate audit and supervision procedures to eliminate any violation, and to fulfil its legal duty of care. This may, for instance, commute the severity of the security measure to be imposed on a corporation when an offence is committed by a representative of the corporation. In terms of multinational companies, ensuring that Turkish subsidiaries adapt and abide by a global compliance programme or implement a local one with internationally acknowledged standards could especially be important and necessary given the extraterritorial effect of foreign laws such as the US Foreign Corrupt Practices Act or UK Anti-Bribery Act.
9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related failings.
Cybersecurity has recently become a hot topic in Turkey. Pursuant to the Electronic Communications Law, the task of determining the politics and strategies to secure national cybersecurity and to coordinate entities in the field of cybersecurity is assigned to the Ministry of Transportation and Infrastructure and the Information Technologies and Communications Institution (ITI).
In the National Cybersecurity Strategy, certain sectors are listed as ‘critical infrastructure sector’ and cybersecurity in these (for both public and private entities) has been highlighted: electronic communication, energy, water management, critical public services, transportation, and banking and finance. The Ministry has published several sets of guidelines for the establishment of operations units for cyber incidents (OUCIs) for entities in these sectors.
ITI has been established as a regulatory and supervisory authority of the telecommunications sector and it has a significant role in providing cybersecurity within electronic communications. In this respect, the National Operations Centre for Cyber Incidents in the framework of ITI ensures co-operation between the OUCIs of other regulatory and supervisory authorities and OUCIs established within the organisation of other public and private entities in the critical infrastructure sector. ITI has announced that one of the cybersecurity strategies for 2020–2023 is to enhance the exchange of information and interaction between the National Operations Centre for Cyber Incidents and the public and private sectors. Accordingly, the exchange of information between these actors is foreseen to be carried a step further, and feedback mechanisms, along with means of communication between participants, are expected to be advanced to create an active cyber security network.
There are also some sector-specific regulations on cybersecurity; for example, the Banking Regulation and Supervision Agency has published a draft regulation for banks on standards for cybersecurity.
Regulation on cybersecurity is likely to become more detailed in the years to come. To reflect its importance, the 11th Development Plan (2019–2023), published by the Turkish presidency, set targets for cybersecurity and highlights the following strategic priorities:
- improvements in technology and human resources within cybersecurity;
- establishing undergraduate and graduate programmes in the area of cybersecurity;
- raising public awareness of this matter; and
- development of a cybersecurity infrastructure.
In addition to the above, there is an ongoing project funded by the European Union, titled ‘Technical Assistance for Achieving Harmony with the EU regarding the Implementation of the NIS Directive’ (Directive (EU) 2016/1148 on security of network and information systems). The overall objective of the project is to contribute to Turkey’s regulatory framework and institutional capacity regarding network and information security.
10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?
Cybercrimes are regulated by the CC under which illegal access to a data processing system, the hindrance or destruction of a system, deletion or alteration of data and the misuse of debit or credit cards are regulated as crimes. The recording of personal data, unlawful delivery or acquisition of the same also constitute crimes. For certain other crimes, such as theft and fraud, the use of a data processing system is regarded as an aggravated form of the crime. There is also a separate law regulating crimes committed via the internet (Law No. 5651).
The fight against cybercrime is undertaken by the Department of Cybercrimes, which is a unit within the General Directorate of Security. This Department was assigned as the point of contact to comply with the requirements of the EU Convention on Cybercrime, to which Turkey became a party in 2014. In addition to tasks relating to preventing and prosecuting cybercrimes, the Department has organised several workshops and educational activities to raise public awareness. In particular, the protection of children against any form of cyber-related abuse is one of the main topics about which the Department frequently publishes leaflets, brochures and the like.
Cross-border issues and foreign authorities
11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.
In principle, the territorial scope of Turkish criminal law is limited to crimes committed within Turkey. However, trial and punishment in Turkey under Turkish laws and procedures for a crime committed in a foreign country, or by a citizen of a foreign state to the detriment of Turkey, is also possible when specific circumstances are satisfied (CC, Articles 10 to 12). Other than that, bribery can be charged as a specific crime with an extraterritorial effect in accordance with amendments in 2005 and 2012 to Article 252 of the CC on bribery in line with the process of implementation of the Organisation for Economic Co-operation and Development’s Convention on Combating Bribery of Foreign Public Officials in International Business Transactions 1997 (the OECD Anti-Bribery Convention). Accordingly, Article 252 of the CC applies to:
- public officials who have been appointed or elected in a foreign country;
- officials serving in international, supranational or foreign state courts (such as judges and members of juries);
- members of international and supranational parliaments;
- persons who perform a public duty for a foreign country, including foreign public institutions;
- citizens or foreign arbitrators who are appointed to arbitrate for a dispute resolution; and
- officials or representatives of international or supranational organisations that have been established by international treaties.
12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.
One of the main challenges that arises in cross-border investigations is the transfer of personal data pursuant to the DPA of 2016. Pursuant to Article 9 of the DPA, personal data may only be transferred abroad with the explicit consent of the data subject. However, if the general exceptions for the processing of personal data under Articles 5/2 and 6/2 exist (such as the existence of legal obligations or the legitimate interests of the data controller), personal data may be transferred abroad without explicit consent, given that the country that will obtain the data provides an adequate level of data protection or that the data controllers in both Turkey and the subject country provide a written undertaking to provide adequate protection and obtain the authorisation of the Data Protection Board. At the time of writing, the Data Protection Board has not yet published details of the countries deemed to be providing adequate protection.
13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?
Notwithstanding the fact that legal persons cannot be held criminally liable under Turkish law, the principle of ne bis in idem is generally recognised at national level. However, Article 9 of the CC states that a person who has been sentenced in a foreign country for a crime committed in Turkey shall be tried again in Turkey. Although Article 16 of the CC provides for the deduction of the time spent in custody or detention in a foreign country from the term of sentence to be served in Turkey, parallel investigations and even verdicts can be possible for individuals where Article 9 of the CC applies. In terms of a legal person, despite the exemption from criminal liability, that person may face administrative sanctions or civil liability in Turkey for the same conduct that was the subject of resolved charges in another country.
In Turkey, there is not anything analogous to the anti-piling on policy in the United States.
14 Are ‘global’ settlements common in your country? What are the practical considerations?
Global settlements are not common practice in Turkey.
15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?
There is no specific or direct rule concerning the effect of decisions made by foreign authorities on an investigation to be conducted in Turkey for the same matter. That being said, the CC allows the retrial of a person who has committed a crime in Turkey or in a foreign country if that person has undertaken an official duty on behalf of the state, even if this person has been convicted by a foreign state court for the same matter. Naturally, the decisions of foreign authorities do not have any bearing on an investigation to be conducted for such cases. Law No. 5781 on International Private and Civil Procedural Law enables the recognition and enforcement of criminal court decisions only for verdicts concerning personal rights.
Economic sanctions enforcement
16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.
No economic sanctions have been implemented by Turkey in recent years. That being said, for many years, Turkey has imposed sanctions on Cyprus and Armenia, such as prevention of direct transport.
17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?
Although official records show that Turkey has no direct trade with Cyprus or Armenia, it is a fact that Turkish merchants trade with these two countries indirectly. However, such relations are not strictly investigated and are not subject to any sanctions under current legislation.
18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?
There is no such concept in Turkey as there is no strict sanctions programme.
19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.
There is no blocking legislation in force in relation to measures undertaken by third countries.
20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?
There is no blocking legislation in force in relation to measures undertaken by third countries.
Before an internal investigation
21 How do allegations of misconduct most often come to light in companies in your country?
Allegations of misconduct generally come to light either through internal sources, such as employees of a company, or external sources, such as customers or distributors. Although company employees often have concerns about being identified as a whistleblower, observations show that the higher the level of misconduct, the more likely it is that employees will disclose it to their superiors. In the case of distributors, whistleblowing seems to be mostly dependent on commercial interests, as distributors are more likely to reveal misconduct when commercial relationships have been destroyed. Internal audits are also a way of detecting misconduct.
22 Does your country have a data protection regime?
Yes, the DPA was enacted on 7 April 2016. Following a two-year post-adoption grace period, the Act became fully enforceable on 7 April 2018. Moreover, Turkey is a party to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108). Although Turkey has been a party to the Convention since 1981, it was not ratified until 17 March 2016.
23 To the extent not dealt with above at question 9, how is the data protection regime enforced?
Pursuant to Article 18 of the DPA, the Data Protection Board is authorised to impose administrative fines on data controllers who breach the DPA by failing to fulfil the obligation of informing the data subject of the full scope of data processing activities, the obligations of data security, the obligation to comply with the Board’s decisions and the obligation to be registered with the Data Controllers Registry. Depending on the nature of the breach of the DPA, administrative fines range from 9,013 to 1,802,641 Turkish lira and may be imposed on natural or legal persons who act as data controllers.
Articles 135 to 138 of the CC also regulate criminal liability regarding the data protection regime. Under the CC, the illegal recording, illegal transfer, distribution or receipt and non-destruction of personal data are regulated as criminal offences. The penalty for these offences is imprisonment for between one and four years, depending on the specific offence.
Although there is no corporate criminal liability in Turkey, security measures (see question 2) can be imposed on legal persons who commit crimes under the data protection regime.
24 Are there any data protection issues that cause particular concern in internal investigations in your country?
In a guideline announced on the DPA website with respect to data controllers and processors, attorneys are deemed to be data controllers in respect of the personal data transferred to them by their clients in relation to the legal services provided to them. Although this requirement has been highly criticised, from the perspective of the DPA, it also applies to the evidence sent to law firms by their clients. Therefore, law firms should also ensure that they comply with all the provisions of the DPA in terms of the data transferred to them by their clients.
In addition, since employees’ emails fall within the scope of the DPA as personal data, seizure of such data within the framework of internal investigations is a cause for particular concern as regards data protection. Article 5 of the DPA allows the processing of personal data under certain circumstances as listed in the Article, two of which are the express consent of the data subject and the legitimate interests of the data controller. Thus, if employees have not given their express consent for the investigation of their emails, a data controller’s best option would be to argue the grounds of legitimate interest for the data processing activities (i.e. internal investigations). It can be argued that processing personal data on the grounds of legitimate interest does not constitute any harm to the data subject’s fundamental rights and freedom but, since this is the most abstract ground yet for data processing, data controllers should be cautious in relying on it without the explicit consent of the data subject.
Currently, the main concerns regarding data protection issues in internal investigations emerge from online interviews being conducted by digital means because of the covid-19 pandemic. Online interviews often fall under the scope of certain provisions of the DPA or the EU General Data Protection Regulation, and employers appear to have started to pay more attention to the safety of their electronic infrastructure for data protection purposes. Unauthorised recording of interviews is another concern raised in relation to data protection.
25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?
There is not a specific set of legal rules regulating this issue. However, it is approached from the perspectives of data protection, right to privacy, freedom of communication and labour law, and practice is formed by the precedents of the Constitutional Court and the Court of Cassation for the time being.
To combine what is set out under these precedents, employees must be informed at an appropriate level (via employment contracts, internal regulations or any other supplement to the employment contract) that the employer can monitor their communications via company emails or phones and their consent for this must be obtained. The employer should ensure that there is a legitimate interest when taking measures that could constitute an intervention of an employee’s right to privacy and that the measure is proportionate.
An intervention without the above-mentioned conditions being present may result in the criminal and civil liability of the employer, and if terminations of employment contracts have been realised as a result of such an intervention, there is an increased likelihood of successful reinstatement claims.
Dawn raids and search warrants
26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.
Article 119 of the CPC stipulates that warrants to search houses, workplaces or non-public closed areas shall only be issued by a judge or a public prosecutor if a search should be carried out without delay. The warrant shall include the act constituting the grounds for the search, the subject of the search, the address where the search is to be conducted and the period for which the warrant is valid. The CPC expects the law enforcement authorities to comply with the scope and content of a search warrant in a proportionate manner. In the event of non-compliance, the subject of the warrant is entitled to compensation (both monetary and moral) from the state.
Article 130 of the CPC introduces a restriction in terms of the search of law offices and necessitates a search warrant to be issued by a court as well as the presence of a public prosecutor, president of the bar association or an attorney representing the president.
27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?
Privileged material can be lawfully protected from seizure during a dawn raid based on attorney–client privilege. The correspondence between attorneys and their clients is deemed to be a significant part of the right of defence. However, to benefit from the privilege, the correspondence must be made between an independent attorney and his or her client. Therefore, correspondence between a company and its in-house attorney cannot benefit from attorney–client privilege. To ensure the protection of privileged material during a dawn raid, it is recommended that such material be marked as confidential beforehand and that the attorney is contacted as soon as possible so that he or she can be present at the raid. This will facilitate the raising of any necessary objections while the dawn raid is being carried out. However, pursuant to the Competition Board’s decision No. 15-42/690-259 of 12 December 2015, in addition to the foregoing (i.e., the requirement for external counsel), the Board concludes that correspondence that does not fall within the scope of the right to defence and that aims to aid the violation, or that is intended to conceal a possible violation, shall not benefit from attorney–client privilege.
When a search is being conducted in a law office, the attorneys working in that office, the president of the bar association, or the attorney representing the president of the bar association may assert that an item to be seized is subject to attorney–client privilege. In this situation, the item is placed inside a separate envelope or package to be stamped. If the courts determine, within 24 hours, that the item is indeed subject to attorney–client privilege, the seized item is returned immediately to the attorney.
28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?
Pursuant to Article 48 of the CPC, an individual may refrain from providing testimony that would lead to him or her, or his or her specified relatives, being prosecuted within the scope of the right against self-incrimination. Moreover, the specified relatives of the accused also have the right to refrain from providing testimony against the accused. Besides, Article 46 of the CPC entitles individuals in certain professions (such as attorneys, healthcare professionals and financial advisers) to refrain from providing testimony regarding information relating to their profession. However, although attorneys may use their right to refrain from providing testimony under any conditions, healthcare professionals and financial advisers cannot enjoy this right if the accused waives the privilege. Pursuant to Article 44 of the CPC, if a witness who has been duly notified and summoned does not appear before the court without providing any excuse, he or she may be compelled to provide testimony before the court. Moreover, a witness who has been introduced before the court by force would also be fined for the expenses arising from his or her absence. The right against self-incrimination and the right to refrain from providing testimony are similarly regulated under Law No. 6100 on Civil Procedure.
Whistleblowing and employee rights
29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?
There is no general framework for whistleblowing in Turkey. That being said, there are financial incentives for whistleblowing relating to certain crimes. For example, whistleblowers who report tax evasion can be awarded up to 10 per cent of the tax imputed and those who report the smuggling of goods or drugs can be awarded up to 25 per cent of the value of the smuggled goods or drugs. Further, the Regulation on the Awards to be Granted to Whistleblowers Who Help with Revealing Terror Crimes or Collecting Evidence or Catching the Offenders, dated 2019, provides for whistleblowers who report terrorist organisations to be granted a financial incentive.
There is no legislation granting legal protection to whistleblowers. Although there is an Act on Witness Protection, it only applies to people who have provided testimonies during criminal proceedings and certain of their relatives.
30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?
There are not any specific rules under employment law that set forth the rights of an employee (whether an officer or a director) under an investigation of any kind. Labour Act No. 4857 lists valid reasons and just causes by analogy and being under an investigation does not constitute a reason for termination on its own. As the Act is silent on the interim period within which the investigation is conducted, most companies regulate the circumstances that apply during this period by internal policies and disciplinary regulations. As long as they are proportionate with the suspected act of the employee and his or her position regarding the misconduct, the employer may take some measures for the sake of the investigation within its right of management.
31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?
If an employee is deemed to have engaged in misconduct following an internal investigation, the employer may proceed with terminating the employment agreement either for valid reasons or just causes, depending on the severity of the employee’s conduct. However, if there are internal company policies or regulations that foresee a different sanction from termination for the specific conduct at hand, the employer is required to follow that procedure to prevent a claim for invalid termination.
If an employee is taken into custody or arrested for a period longer than notice periods within the scope of an external investigation, this constitutes a just cause for termination.
The Labour Act only regulates termination of employment and is silent on disciplinary sanctions that could be taken during a current employment relationship. However, a company may determine disciplinary sanctions in its internal policies and regulations. From a labour law standpoint, it is especially important in drawing up internal company rules to set out the framework in a specific manner, as a sanction imposed without a clear ground may entitle an employee to several claims against the employer.
32 Can an employee be dismissed for refusing to participate in an internal investigation?
Whether refusal by an employee to participate in an internal investigation could be a reason for termination of the employment agreement depends on the specific circumstances of the case. If the refusal is of a nature that could be construed as a breach of the employment agreement or the employee’s obligation of due care and loyalty, then it may result in dismissal.
Commencing an internal investigation
33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?
The methods for conducting internal investigations are still a growing area for Turkish corporations. Therefore, drawing up a document that sets out the scope of an investigation is not common. For this reason, it is highly recommended to have a document that can also serve as a road map of the investigation, both to enable an organised and complete investigation and to keep the whole process under control. To achieve this, the document should include the purpose and scope of the investigation, the procedure to be followed and the actions to be taken (interviews with employees, examination of corporate documents or emails, etc.), the units or individuals to be involved and the means of communication with the relevant parties.
34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?
Although its application in practice is quite rare, failure to report a crime at the very instant it has been committed, or when it is still possible to limit its consequences, constitutes a crime that is punishable by imprisonment for up to one year under the CC. Other than that, there are no mandatory reporting obligations.
35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?
If a company receives a notice from a law enforcement authority seeking production of documents, it should comply with the notice in an appropriate way. Thus, pursuant to Article 332 of the CPC, it is obligatory to reply within 10 days to an information request raised by a public prosecutor, judge or court during the investigation and prosecution phase. If it is not possible to provide this information in due time, addressed parties must notify the appropriate person or entity within the same period (i.e., 10 days) why they cannot provide the information and when they will be providing it. Those who do not comply with this requirement will be subject to the consequences of Article 257 of the CC, which is misconduct in office.
36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?
Only Law No. 6362 on Capital Markets sets out a disclosure obligation for information, events and developments that may affect the value and price of capital market instruments or investment decisions by investors. Article 15 of Law No. 6362 defines such cases as material events and, according to the Capital Market Board’s Guidebook on Material Events, material events include administrative and judicial proceedings that directly concern the issuer, or court actions and sanctions against those having a material duty and responsibility for the issuer.
37 How are internal investigations viewed by local enforcement bodies in your country?
In practice, the degree of importance a public prosecutor will attribute to an internal investigation very much depends on the specific circumstances of the case, and the quality and content of the findings of an internal investigation. As there is not any legal rule granting internal investigations a role in the official investigation stage, the public prosecutor and, at the next stage, the criminal court, have full discretion on how to view it.
38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?
There are insufficient sources of specific guidance on attorney–client privilege in respect of internal investigations. Therefore, the extent to which attorney–client privilege will apply to the relationship and communications between in-house or external counsel and the perpetrators of white-collar crime remains unclear. In that respect, decisions by the Turkish Competition Board are helpful for guidance. The Board has concluded that attorney–client protection covers any correspondence in relation to a client’s right of defence and documents prepared within the scope of an independent attorney’s legal service.
39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?
In addition to the information in question 29, the Advocate Law of 19 March 1969 (1136) and the CPC set out the key principles of attorney–client privilege. Accordingly, the Advocate Law regulates attorney–client privilege for attorneys. According to Article 36 (Right to Keep Secrets), attorneys cannot disclose any document or information obtained while practising their profession. Similarly, Article 130/2 of the CPC sets out that any material seized as a part of a search conducted in an attorney’s office must be returned immediately to the attorney if the material is understood to relate to the professional relationship between a client and that attorney. There are not any differences between an individual client and a corporation in that respect.
40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?
There are no specific provisions that define the application of attorney–client privilege to in-house and external counsel in Turkey. However, the Turkish Competition Board stated in its Dow decision that correspondence with an independent attorney falls within the scope of attorney–client privilege and shall be protected. In other words, in-house counsel employed by a corporation that is the subject of an investigation cannot enjoy attorney–client privilege.
41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?
Currently, there is no law or precedent touching on the level of privilege that a foreign lawyer will enjoy compared to a domestic one. Under the Turkish Constitution, attorney–client privilege is protected under the right to legal remedies. From a constitutional point of view, there should be no restriction to the attorney–client privilege between a client and a foreign attorney.
42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?
There are no regulations to guide us as to whether waiver of attorney–client privilege would be regarded as a co-operative step.
43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?
No, we do not have such a concept.
44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?
There are no rules or regulations in this respect.
45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?
There are no rules or regulations under Turkish law relating to common interest privileges.
46 Can privilege be claimed over the assistance given by third parties to lawyers?
The principles of attorney–client privilege apply to the correspondence between attorney and client and not to assistance from third parties to lawyers.
47 Does your country permit the interviewing of witnesses as part of an internal investigation?
There are no rules preventing companies from interviewing witnesses as part of an internal investigation. However, obtaining consent from a witness would prevent any subsequent complaint from a criminal law or data privacy law perspective.
48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?
There are no court cases or regulations relating to claiming privilege over attorney reports that are based on internal witness interviews. Therefore, good practice would be to assume privilege only when external counsel is taking notes during witness interviews or preparing attorney reports to establish a legal defence.
49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?
There are no legal or ethical requirements or guidance under Turkish law to consider when conducting a witness interview of an employee. The general principles and provisions about data privacy law, employment law and criminal law should be adhered to during interviews (note that the latter can be an issue when, for instance, a witness claims that his or her interview took place by force and his or her freedom was restricted, or that the interview was recorded without his or her consent).
50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?
There is no specific format or guidance for conducting an interview. Internal interviews are usually conducted in a Q&A format. In practice, documents might be shown to the interviewees as well. Witnesses may choose to attend the interviews with their counsel.
As elsewhere in the world, internal investigations and interviews have been conducted remotely since the emergence of the covid-19 outbreak. So, conducting internal interviews via videoconferences has necessarily become a trend during the pandemic. For the same reason, digitalisation of corporate records has gained a specific importance. Although communication of these records with interviewees and witnesses virtually raises other concerns, companies appear already to have started to allocate more time and resources to the digitalisation of their documents.
Reporting to the authorities
51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?
As stated in question 34, although its application in practice is quite rare, failure to report a crime at the very instant it is committed, or when it is still possible to limit its consequences, constitutes a crime that is punishable by imprisonment for up to one year under the CC. Other than that, there are no mandatory reporting obligations.
52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?
Self-reporting should be assessed in each case by taking into account the real risks and strategy in the matter. It would be advisable to self-report if there is an imminent threat of external investigation.
53 What are the practical steps you need to take to self-report to law enforcement in your country?
There is no guidance on any practical steps regarding self-reporting. When a corporation or individual decides to self-report, it would be advisable also to correctly determine the relevant law enforcement body. However, note that effective remorse is available for certain crimes (e.g., bribery under the CC).
Responding to the authorities
54 In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?
Every communication between a law enforcement authority and a company is made in writing. However, in practice, it is advisable to have good communications with a public prosecutor to better understand the claims and status of the investigation. Other than this, there is no mechanism for plea bargaining in Turkey.
55 Are ongoing authority investigations subject to challenge before the courts?
The decision to initiate an investigation can be challenged under the procedural rules to which the authority is subject. For example, if a ministry initiates an investigation against a company, this administrative action can be challenged as per Law No. 2577 on Administrative Procedure.
56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?
It would be advisable to have a central supervision mechanism for cross-border investigations. The consistency of negotiation packages can be affected by disclosure limitations imposed on companies through legal requirements (e.g., data protection or blocking statutes).
57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?
There is no specific regulation regarding production of material in a different jurisdiction. The authorities co-operate with each other, and there are some reciprocity agreements between countries that enable a request to be recognised and enforced in another jurisdiction. However, note that, in practice, it is not always quick and easy to have effective co-operation because of bureaucracy.
58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?
Turkish authorities share information with foreign authorities through the existing bilateral and multilateral agreements on mutual legal assistance.
59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?
As explained in question 62, any documents produced for a court file are open to third parties unless the court grants a confidentiality decision on the file. Having said that, as per Article 157 of the CPC, the procedures during the investigation phase before a public trial are confidential, provided that there is no harm to the right of defence. However, once a criminal trial is initiated, it is open to the public.
60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?
If compliance with a request made by an enforcement authority would violate the laws of another country, it would be advisable for that company to explain the reasons why it cannot provide the requested documentation or information to the local law enforcement authority.
61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?
See question 12 regarding data protection rules as blocking statutes in Turkey.
62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?
In principle, any documents produced for a court file are open to third parties. If the relevant party submits its request for confidentiality about the material presented, it must give a legitimate reason for that request. In such a case, the court will assess whether there is legitimate and reasonable cause to ask for the material in question to be kept confidential.
Prosecution and penalties
63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?
As there is no criminal corporate liability, the directors, board members or representatives of a corporation may face judicial fines or imprisonment for misconduct, but the corporation itself cannot be sanctioned. Other than this, administrative or civil liability may arise for both the corporation and any individuals concerned, in connection with misconduct.
64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?
Article 58 of Law No. 4734 on Public Procurement sets forth a suspension regime of one to two years for those who have been involved in, among other offences, collusive tendering or document forging. Moreover, Law No. 4734 sets forth that those who refrain from entering into a contract after procuring a tender will be suspended for between six months and a year. If the suspended company is an equity company, any shareholders owning more than half of its capital would also be affected by the suspension. If the suspended company owns more than half the capital of another company, that company would also be suspended accordingly.
65 What do the authorities in your country take into account when fixing penalties?
Article 61 of the CC lists the factors that a criminal judge shall consider when fixing a penalty between the lower and upper limits for the offence at hand. Those factors are the way in which the offence was committed, how the damage occurred, the severity of the perpetrator’s fault, and so on. Following that, Article 62 of the CC provides the following grounds for discretionary mitigation: the background and social relations of the perpetrator; the perpetrator’s conduct after the act and during the proceedings; and the possible effects of the punishment on the perpetrator’s future.
Resolution and settlements short of trial
66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?
Neither non-prosecution agreements nor deferred prosecution agreements are available in Turkey. Although it does not have the same scope, one may note the following.
Pursuant to Article 171 of the CPC, offences that are subject to a penalty of imprisonment for less than three years can be deferred by the prosecutor for five years, provided that they are not subject to reconciliation or prepayment. However, certain conditions must be met before the prosecutor can make this decision. Those conditions are that the accused should not previously have been sentenced to imprisonment based on an intentional crime; the investigation should indicate that the accused will not commit any crimes after a possible deferral decision; the deferral must be more beneficial to the accused and society than prosecution; and the damage that is determined by the public prosecutor and suffered by the victim or the general public must be fully compensated. If the accused does not intentionally commit a crime during the deferral period, the prosecution will be dropped. Otherwise, public trial will commence. Article 171 does not apply to the following offences:
- forming, running or becoming a member of an organisation for the purpose of committing crime, and the offences committed within the scope of activities of the organisation;
- offences committed by or against a public officer in connection with his or her public duties, and military offences committed by soldiers; and
- offences committed against sexual integrity.
On the other hand, Article 253 of the CPC regulates reconciliation by mediation for certain offences. In this regard, the outcomes of the offence can be compensated between the accused and the private person or entity without proceeding with a prosecution. If the offence is subject to reconciliation, the prosecutor will initiate the procedure ex officio and present the file to the reconciliation bureau. If all the parties agree to proceed with reconciliation, the court will defer announcement of the verdict until the conditions agreed under reconciliation are met by the accused. If the accused violates the reconciliation agreement within this period, the court will announce the verdict.
67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?
With reference to our explanations regarding corporate liability under question 2 and non-prosecution agreements and deferred prosecution agreements under question 66, there is no such concept in Turkey.
68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?
In Turkish law, settlement with law enforcement authorities is subject to certain requirements and limitations in terms of scope. To exemplify, penalties arising from the offence of smuggling are left out of the scope of settlement for tax penalties or administrative fines. In terms of settlement for criminal liability, the possibility to settle is provided for certain offences, subject to a complaint by the victim, with some exceptions, such as fraud or the disclosure of business secrets, banking secrets or information relating to customers. Following a recent amendment to the CPC, violation of freedom of work and labour, abuse of trust, and purchase or acceptance of property acquired through committing an offence are now subject to settlement.
69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?
There is no such concept under Turkish law. However, it is possible under the CPC for the criminal court to appoint a custodian for the management of the corporation during the investigation or criminal proceedings if the court has serious doubt that a crime has been committed and it is necessary to shed light on the material facts. That being said, the role of such a custodian is not related to monitoring and compliance with laws, but rather to financial management of the company.
70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?
Turkish law allows parties to initiate parallel private actions and the private plaintiffs may gain access to any of the authorities’ files that are considered as public domain unless there is a confidentiality restriction.
Publicity and reputational issues
71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.
Article 157 of the CPC provides for the confidentiality of an investigation and Article 285 of the CC deems a breach of the confidentiality of an investigation to be an offence subject to imprisonment for between one and three years. Only the victim, the complainant and the lawyers of the parties are allowed to review the investigation file and take copies to the extent that confidentiality is maintained. After the criminal case is filed, the trials are open to the general public in principle. However, where public morality and security so requires, the court may opt for confidential conduct of a trial. Confidentiality of a trial when the accused is less than 18 years old is mandatory.
72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?
Generally, lawyers and public relations firms work together in managing corporate communications. In sensitive cases that require communication with government bodies, in particular, lobbying firms may also take a role.
73 How is publicity managed when there are ongoing related proceedings?
When such publicity is deemed necessary by the corporation, it is mostly managed by press statements.
Duty to the market
74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?
Mandatory disclosure in these circumstances may be required under the Law on Capital Markets, as described in question 36.
75 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?
Following the OECD’s 2019 notice to Turkey regarding its continuous failures to implement the key aspects of the OECD Anti-Bribery Convention, Turkey submitted a report on 1 October 2019 explaining the actions taken for each recommendation set out in the notice. The OECD’s assessment of the report is yet to be seen and its anticipated assessment of Turkey’s report may trigger legislative activity that would address corporate misconduct.
Although not directly related to corporate misconduct, certain regulations and sanctions currently in the pipeline focus particularly on media and social media companies such as YouTube, Twitter and Netflix, and there have been very recent legislative changes for the purpose of regulating these platforms. On 31 July 2020, a law amending the Law on Regulation of Publications on the Internet and Suppression of Crimes Committed By Means of Such Publications was enacted. The newly enacted law introduced a new obligation to foreign social network providers with more than one million daily accesses in Turkey, to appoint at least one representative to handle any administrative or judiciary notices, notifications or requests, and to fulfil any obligations set out by law. These providers are obliged to prepare reports every six months on certain topics set out by law. Furthermore, Law No. 7252 on the Establishment of a Digital Platforms Commission and Amendment of Certain Laws, which was published in the Official Gazette (No. 31199 of 28 July 2020), introduced a Digital Platforms Commission to be established in the Grand National Assembly of Turkey, which is entitled to conduct, examine, discuss and report any measures to prevent use of the internet that is in breach of law, and provide recommendations regarding the matter. These legislative changes are expected to introduce new regulatory practices in the coming year and are expected to have a significant effect in particular on the conduct of media and social media companies.
 Filiz Toprak Esin is a partner and Asena Aytuğ Keser is a senior associate at Gün + Partners.