General context, key principles and hot topics

  1. Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy

Since the attempted coup on 15 July 2016, criminal investigations relating to the Fethullah Gulen Terrorist Organisation (FETO) have been initiated. These investigations have also extended to corporations; those being funded by FETO or financing any associated corpo- ration or institution, or having any kind of connection with FETO, have also been under the spotlight of the law enforcement authorities. The Financial Crimes Investigation Board (MASAK) is the organisation that has been involved to the greatest extent and has had an important role in these investigations as, in most cases, they concern financing terrorism. This involvement has resulted in new legal regulations that have extended the scope of MASAK's authority and reorganised its structure. However, it is not possible to give any detailed infor- mation about these investigations as these procedures are highly confidential and are not reported in the press.

  1. Outline the legal framework for corporate liability in your

Under Turkish law, corporations cannot be held criminally liable. When a crime is committed for the benefit of a legal person by the participation of its representatives or authorised bodies, the Turkish Criminal Code (CC) provides for security measures to be imposed on that legal person. Those measures are listed as the cancellation of business licences granted by a public authority, and the seizure of goods that are used, allocated for or gained as a result of the commission of crime. In addition, in cases where certain crimes (e.g., fraud, collusive tendering, bribery, money laundering) are committed by representatives or authorised bodies

  1. Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

There are no special authorities relating to the prosecution of corporations. When a crime is committed by a corporation, public prosecutors and criminal courts prosecute representa- tives or members of authorised bodies of the corporation. In addition, pursuant to Law No. 5549 on Prevention of Laundering Proceeds of Crime, MASAK is authorised to convey to the public prosecutor's office any case in which there is serious suspicion that a money laundering or terrorist financing offence has been committed.

  1. What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

Having an impression that a crime has been committed is sufficient for the public prosecutor to trigger an investigation. According to Article 160 of the Criminal Procedure Code (CPC), the public prosecutor would start an investigation as soon as he or she becomes aware of any impression of a crime being committed, by any means (e.g., the reporting of a crime).

  1. How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

Whereas Law No. 2577 on Administrative Procedure provides application to a superior administrative body or the filing of a cancellation action as legal remedies to challenge the lawfulness or scope of an administrative action, the CPC provides an objection procedure before the issuing authority or its superior. The procedure to be followed when filing these applications and the time limits within which they should be made are set out clearly by these laws. Similar procedures are also set out by various special laws, such as the Law on Capital Markets and the Law on Misdemeanours.

  1. Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Although it is not an agreement technically, there is an effective remorse mechanism (leniency-type mechanism) under the CC that provides for either a reduction in the punish- ment or full immunity. This mechanism applies for certain crimes only as prescribed by the CC; these include bribery and money laundering. In terms of bribery, if either the perpe- trator, participant, intermediary or accessory to a crime reports the same to the authorities before the law enforcement bodies become aware of it, that person will not be subject to any punishment for bribery. In terms of money-laundering, there will be no punishment for a person who helps the law enforcement bodies to seize the assets that are the subject of a crime or reports their location before the commencement of criminal proceedings.

There are some reconciliation mechanisms that apply with regard to tax and customs-related administrative investigations and sanctions. These mechanisms do not provide for complete immunity, but do provide for considerable decreases in the fines and penalties imposed.

  1. What are the top priorities for your country's law enforcement authorities?

In parallel with our response to question 1, the fight against terrorism has been the top priority of law enforcement authorities in Turkey. There have been amendments to several acts related to counter-terrorism and to the rules of the CPC concerning the investigation and trial procedures for such crimes.

Cyber-related issues

  1. Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities to cybersecurity-related

Cybersecurity has recently become a hot topic in Turkey. According to the Electronic Communications Law, the task of determining the politics and strategies to secure national cybersecurity and to coordinate entities in the field of cybersecurity is assigned to the Ministry of Transportation and Infrastructure and the Information Technologies and Communications Institution (ITI).

In the National Cyber Security Strategy, certain sectors are listed as 'critical infrastructure sector' and cybersecurity in these (for both public and private entities) has been highlighted: electronic communication, energy, water management, critical public services, transporta- tion, and banking and finance. The Ministry has published several sets of guidelines for the establishment of operations units for cyber incidents (OUCIs) for entities in these sectors.

ITI has been established as a regulatory and supervisory authority of the telecommu- nications sector and it has a significant role in providing cybersecurity within electronic communications. In this respect, the National Operations Centre for Cyber Incidents in the framework of ITI ensures co-operation between the OUCIs of other regulatory and supervi- sory authorities and OUCIs established within the organisation of other public and private entities in the critical infrastructure sector.

There are also some sector-specific regulations on cybersecurity; for example, the Banking Regulation and Supervision Agency has published a draft regulation for banks on standards for cybersecurity.

Regulation on cybersecurity is likely to become more detailed in the years to come. To reflect the importance of the topic for the future, the 11th Development Plan (2019–2023), published by the Turkish presidency, set targets for cybersecurity and highlights the following strategic priorities:

  • improvements in technology and human resources within cybersecurity;
  • establishing undergraduate and graduate programmes in the area of cybersecurity;
  • raising public awareness of this matter; and
  • development of a cybersecurity
  1. Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Cybercrimes are regulated under the CC under an individual section where illegal access to a data processing system, the hindrance or destruction of a system, deletion or alteration of data and the misuse of debit or credit cards are regulated as crimes. The recording of personal data, unlawful delivery or acquisition of the same also constitutes a crime. For certain crimes, such as theft and fraud, commission of a crime through the use of a data processing system is regarded as an aggravated form of the crime. There is also a separate law regulating crimes committed via the internet (Law No. 5651).

The fight against cybercrime is undertaken by the Department of Cybercrimes, which is a unit within the General Directorate of Security. This Department was assigned as the point of contact to comply with the requirements of the EU Convention on Cybercrime, to which Turkey became a party in 2014. In addition to tasks relating to preventing and prosecuting cybercrimes, the Department has organised several workshops and educational activities to raise public awareness. In particular, the protection of children against any form of cyber-related abuse is one of the main topics about which the Department frequently publishes leaflets, brochures, etc.

Cross-border issues and foreign authorities

  1. Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give

In principle, the territorial scope of Turkish criminal law is limited to crimes committed within Turkey. However, trial and punishment in Turkey under Turkish laws and procedures for a crime committed in a foreign country, or by a citizen of a foreign state to the detriment of Turkey, is also possible when specific circumstances are satisfied (Articles 10 to 12, CC). Other than that, bribery can be charged as a specific crime with an extraterritorial effect in accordance with amendments to Article 252 of the CC on bribery in 2005 and 2012 in line with the process of implementation of the Organisation for Economic Co-operation and Development' Convention on Combating Bribery of Foreign Public Officials in International Business Transactions 1997 (the OECD Anti-Bribery Convention). Accordingly, Article 252 of the CC applies to:

  • public officials who have been appointed or elected in a foreign country;
  • officials serving in international, supranational or foreign state courts (such as judges and members of juries);
  • members of international and supranational parliaments;
  • persons who perform a public duty for a foreign country, including foreign public institutions;
  • citizens or foreign arbitrators who are appointed to arbitrate for a dispute resolution; and
  • officials or representatives of international or supranational organisations that have been established by international
  1. Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries

One of the main challenges that arises in cross-border investigations is the transfer of personal data pursuant to Law No. 6698 on the Protection of Personal Data (DPA) of 2016. Pursuant to Article 9 of the DPA, personal data may only be transferred abroad with the explicit consent of the data subject. However, if the general exceptions for the processing of personal data under Articles 5/2 and 6/2 exist (such as the existence of legal obligations or the legiti- mate interests of the data controller), personal data may be transferred abroad without explicit consent, given that the country that will obtain the data provides an adequate level of data protection or that the data controllers in both Turkey and the subject country provide a written undertaking to provide adequate protection and obtain the authorisation of the Data Protection Board. As at September 2019, the Data Protection Board has not published the countries deemed to be providing adequate protection.

  1. Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the 'anti-piling on' policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

Notwithstanding the fact that legal persons cannot be held criminally liable under Turkish law, the principle of ne bis in idem is generally recognised at national level. However, Article 9 of the CC states that a person who has been sentenced in a foreign country for a crime committed in Turkey shall be tried again in Turkey. Although Article 16 of the CC provides for the deduc- tion of the time spent in custody or detention in a foreign country from the term of sentence to be served in Turkey, parallel investigations and even verdicts can be possible for individuals where Article 9 of the CC applies. In terms of a legal person, in spite of the exemption from criminal liability, that person may face administrative sanctions or civil liability in Turkey for the same conduct that was the subject of resolved charges in another country.

In Turkey, there is not anything analogous to the anti-piling on policy as exists in the United States.

  1. Are 'global' settlements common in your country? What are the practical considerations?

Global settlements are not common practice in Turkey.

  1. What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

There is no specific or direct rule concerning the effect of the decisions of foreign authorities on an investigation to be conducted in Turkey for the same matter. That being said, the CC allows the retrial of a person who has committed a crime in Turkey or in a foreign country if that person has undertaken an official duty on behalf of the state, even if this person has been convicted by a foreign state court for the same matter. Naturally, the decisions of foreign authorities do not have any bearing on an investigation to be conducted for such cases. Law No. 5781 on International Private and Civil Procedural Law enables the recognition and enforcement of criminal court decisions only for verdicts concerning personal rights.

Economic sanctions enforcement

  1. Describe your country's sanctions programme and any recent sanctions imposed by your

No economic sanctions have been implemented by Turkey in recent years. That being said, for many years, Turkey has imposed sanctions on Cyprus and Armenia, such as prevention of direct transport.

  1. What is your country's approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Although official records show that Turkey has no direct trade with Cyprus or Armenia, it is a fact that Turkish merchants trade with these two countries indirectly. However, such relations are not strictly investigated or are not subject to any sanctions under the legislation.

So, it could be said that Turkey does not have a strict approach to sanctions enforcement.

  1. Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

There is no such concept in Turkey as there is not a strict sanctions programme.

  1. Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation

There is no blocking legislation in force in relation to measures undertaken by third countries.

  1. To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

There is no blocking legislation in force in relation to measures undertaken by third countries.

Before an internal investigation

  1. How do allegations of misconduct most often come to light in companies in your country?

Allegations of misconduct generally come to light either through internal sources, such as employees of a company, or external sources, such as customers or distributors. Although company employees often have concerns about being identified as a whistleblower, observa- tions show that the higher the level of misconduct, the more likely it is that employees will disclose it to their superiors. In the case of distributors, whistleblowing seems to be mostly dependent on commercial interests, as distributors are more likely to reveal misconduct when commercial relationships have been destroyed. Internal audits are also a way of detecting misconduct.

Information gathering

  1. Does your country have a data protection regime?

Yes, the DPA was enacted on 7 April 2016. Following a two-year post-adoption grace period, the Act became fully enforceable in Turkey on 7 April 2018. Moreover, Turkey is a party to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 108). Although Turkey has been a party to the Convention since 1981, it was not ratified until 17 March 2016.

  1. To the extent not dealt with above at question 8, how is the data protection regime enforced?

Pursuant to the DPA, the data protection regime is enforced by the Data Protection Board, and by criminal courts and public prosecutors for crimes regarding data protection offences.

Pursuant to Article 18 of the DPA, the Board is authorised to impose administrative fines on data controllers who breach the DPA by failing to fulfil the obligation of informing the data subject of the full scope of data processing activities, the obligations of data security, the obligation to comply with the Board's decisions and the obligation to be registered with the Data Controllers Registry. Depending on the nature of the breach of the DPA, administra- tive fines range from 7,352 to 1,470,580 Turkish lira and may be imposed on natural or legal persons who act as data controllers.

In April 2019, the Board imposed a fine of 1.6 million Turkish lira on Facebook because of its incapacity to block unauthorised access to the personal data of its users by some appli- cation programming interfaces, its failure to take explicit consent from the users and to duly inform the Board about the data breaches. Marriott International was fined 1.4 million Turkish lira for unauthorised access to customers' personal data within their information technology system for almost four years.

Articles 135 to 138 of the CC also regulate criminal liability regarding the data protec- tion regime. Under the CC, the illegal recording, illegal transfer, distribution or receipt and non-destruction of personal data are regulated as criminal offences. The penalty for these offences is imprisonment for between one and four years, depending on the specific offence. Although there is no corporate criminal liability in Turkey, security measures (see question 2) can be imposed on legal persons who commit crimes under the data protection regime.

  1. Are there any data protection issues that cause particular concern in internal investigations in your country?

In a guideline announced on the DPA website with respect to data controllers and processors, attorneys are deemed to be data controllers in respect of the personal data transferred to them by their clients in relation to the legal services provided to them. Although this requirement has been highly criticised, from the perspective of the DPA, it also applies to the evidence sent to law firms by their clients. Therefore, law firms should also ensure that they comply with all the provisions of the DPA in terms of the data transferred to them by their clients.

In addition, since employees' emails fall within the scope of the DPA as personal data, seizure of such data within the framework of internal investigations is a cause for particular concern as regards data protection. Article 5 of the DPA allows the processing of personal data under certain circumstances as listed in the Article, two of which are the express consent of the data subject and the legitimate interests of the data controller. Thus, if employees did not give their express consent for the investigation of their emails, a data controller's best option would be to argue the grounds of legitimate interest for the data processing activities (i.e., internal investigations). It can be argued that processing personal data on the grounds of legitimate interest does not constitute any harm to the data subject's fundamental rights and freedom but, since this is the most abstract ground yet for data processing, data controllers should be cautious in relying on it without the explicit consent of the data subject.

  1. Does your country regulate or otherwise restrict the interception of employees' communications? What are its features and how is the regime enforced?

There is not a specific set of legal rules regulating this issue. However, it is approached from the perspective of data protection, right to privacy, freedom of communication and labour law, and practice is formed by the precedents of the Constitutional Court and the Court of Cassation for the time being.

To combine what is set out under these precedents, employees must be informed at an appropriate level (via employment contracts, internal regulations or any other supplement to the employment contract) that the employer can monitor their communications via company emails or phones and their consent for this must be obtained. The employer should ensure that there is a legitimate interest when taking measures that could constitute an intervention of an employee's right to privacy and that the measure is proportionate.

An intervention without these above conditions being present may result in the criminal and civil liability of the employer, and if terminations of employment contracts have been realised as a result of such an intervention, there is an increased likelihood of successful rein- statement claims.

Dawn raids and search warrants

  1. Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Article 119 of the CPC stipulates that search warrants for houses, workplaces or non-public closed areas shall only be issued by a judge or a public prosecutor if a search should be carried out without delay. The warrant shall include the act constituting the grounds for the search, the subject of the search, the address where the search is to be conducted and the period for which the warrant is valid. The CPC expects the law enforcement authorities to comply with the scope and content of a search warrant in a proportionate manner. In the event of non-compliance, the subject of the warrant is entitled to compensation (both monetary and moral) from the state.

  1. How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

Privileged material can be lawfully protected from seizure during a dawn raid based on attorney–client privilege. The correspondence between attorneys and their clients is deemed to be a significant part of the right of defence. However, to benefit from the privilege, the correspondence must be made between an independent attorney and his or her client. Therefore, correspondence between a company and its in-house attorney cannot benefit from attorney–client privilege. To ensure the protection of privileged material during a dawn raid, it is recommended that such material be marked as confidential beforehand and that the attorney is contacted as soon as possible so that he or she can be present at the raid. This will facilitate the raising of any necessary objections while the dawn raid is being carried out. On the other hand, pursuant to the Competition Board's decision No. 15-42/690-259, dated 12 December 2015, in addition to the foregoing (i.e., the requirement for external counsel), the Board concludes that correspondence that does not fall within the scope of the right to defence and that aims to aid the violation, or that is intended to conceal a possible violation, shall not benefit from attorney–client privilege.

  1. Under what circumstances may an individual's testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

Pursuant to Article 48 of the CPC, an individual may refrain from providing testimony that would lead to him or her, or his or her specified relatives, being prosecuted within the scope of the right against self-incrimination. Moreover, the specified relatives of the accused also have the right to refrain from providing testimony against the accused. Besides, Article 46 of the CPC entitles individuals in certain professions (such as attorneys, healthcare profes- sionals and financial advisers) to refrain from providing testimony regarding information relating to their profession. However, while attorneys may use their right to refrain from providing testimony under any conditions, healthcare professionals and financial advisers cannot enjoy this right if the accused waives the privilege. Pursuant to Article 44 of the CPC, if a witness who has been duly notified and summoned does not appear before the court without providing any excuse, he or she may be compelled to provide testimony before the court. Moreover, a witness who has been introduced before the court by force would also be fined for the expenses raised from his or her absence. The right against self-incrimination and the right to refrain from providing testimony are similarly regulated under Law No. 6100 on Civil Procedure.

Whistleblowing and employee rights

  1. Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

There is no general framework for whistleblowing in Turkey. That being said, there are finan- cial incentives for whistleblowing relating to certain crimes. For example, whistleblowers who report tax evasion can be awarded up to 10 per cent of the tax imputed and those who report the smuggling of goods or drugs can be awarded up to 25 per cent of the price of the smuggled goods or drugs. A recent regulation provides for whistleblowers reporting terrorist organisations also to be granted a financial incentive.

There is no legislation granting legal protection to whistleblowers. Although there is an Act on Witness Protection, it only applies to people who have provided testimonies during criminal proceedings and certain of their relatives.

  1. What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

There are not any specific rules under employment law that set forth the rights of an employee (whether an officer or a director) under an investigation of any kind. Labour Act No. 4857 (LA) lists valid reasons and just causes by analogy, and being under an investigation does not constitute a reason for termination on its own. As the LA is silent on the interim period within which the investigation is conducted, most companies regulate the circumstances that apply during this period by internal policies and disciplinary regulations. As long as they are proportionate with the suspected act of the employee and his or her position regarding the misconduct, the employer may take some measures for the sake of the investigation within its right of management.

  1. Do employees' rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

If an employee is deemed to have engaged in misconduct following an internal investiga- tion, the employer may proceed with terminating the employment agreement either for valid reasons or just causes, depending on the severity of the employee's conduct. However, if there are internal company policies or regulations that foresee a different sanction from termina- tion for the specific conduct at hand, the employer is required to follow that procedure to prevent a claim for invalid termination.

If an employee is taken into custody or arrested for a period longer than notice periods within the scope of an external investigation, this constitutes a just cause for termination.

The LA only regulates termination of employment and is silent on disciplinary sanctions that could be taken during a current employment relationship. However, a company may determine disciplinary sanctions in its internal policies and regulations. From a labour law standpoint, it is especially important in drawing up internal company rules to set out the framework in a specific manner, as a sanction imposed without a clear ground may entitle an employee to several claims against the employer.

  1. Can an employee be dismissed for refusing to participate in an internal investigation?

Whether refusal by an employee to participate in an internal investigation could be a reason for termination of the employment agreement depends on the specific circumstances of the case. If the refusal is of a nature that could be construed as a breach of the employment agree- ment or the employee's obligation of due care and loyalty, then it may result in dismissal.

Commencing an internal investigation

  1. Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

The methods for conducting internal investigations are still a growing area for Turkish corpo- rations. Therefore, drawing up a document that sets out the scope of an investigation is not common. That is why it is highly recommended to have a document that can also serve as a road map of the investigation, both to have an organised and complete investigation and to keep the whole process under control. To achieve this, the document should include the purpose and scope of the investigation, the procedure to be followed and the actions to be taken (interviews with employees, examination of corporate documents or emails, etc.), the units or individuals to be involved and the means of communication with the relevant parties.

  1. If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

Although its application in practice is quite rare, failure to report a crime at the very instant it has been committed, or when it is still possible to limit its consequences, constitutes a crime that is punishable by imprisonment for up to one year under the CC. Other than that, there are no mandatory reporting obligations.

  1. What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

If a company receives a notice from a law enforcement authority seeking production of documents, it should comply with the notice in an appropriate way. Thus, pursuant to Article 332 of the CPC, it is obligatory to reply within 10 days to an information request raised by a public prosecutor, judge or court during the investigation and prosecution phase. If it is not possible to provide this information in due time, addressed parties must notify the appropriate person or entity why they cannot provide the information and when they will be providing it within the same period of time (i.e., 10 days). Those who do not comply with this requirement will be subject to the consequences of Article 257 of the CC, which is misconduct in office.

  1. At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

Only Law No. 6362 on Capital Markets sets out a disclosure obligation for information, events and developments that may affect the value and price of capital market instruments or investment decisions by investors. Article 15 of Law No. 6362 defines such cases as mate- rial events and, according to the Capital Market Board's Guidebook on Material Events, material events include administrative and judicial proceedings that directly concern the issuer, or court actions and sanctions against those having a material duty and responsibility for the issuer.

  1. How are internal investigations viewed by local enforcement bodies in your country?

In practice, the degree of importance a public prosecutor will attribute to an internal inves- tigation very much depends on the specific circumstances of the case, and the quality and content of the findings of an internal investigation. As there is not any legal rule granting internal investigations a role in the official investigation stage, the public prosecutor and, at the next stage, the criminal court, have full discretion on how to view it.

Attorney–client privilege

  1. Can attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

There are insufficient sources of specific guidance on attorney–client privilege in respect of internal investigations. Therefore, the extent to which attorney–client privilege will apply to the relationship and communications between in-house or external counsel and the perpetrators of white-collar crime remains unclear. In that respect, decisions by the Turkish Competition Board are helpful for guidance. The Board concluded that attorney–client protection covers any correspondence in relation to a client's right of defence and documents prepared within the scope of an independent attorney's legal service.

  1. Set out the key principles or elements of the attorney–client privilege in your country as it relates to Who is the holder of the privilege? Are there any differences when the client is an individual?

In addition to the information in question 28, the Advocate Law of 19 March 1969 (1136) and the CPC set out the key principles of attorney–client privilege. Accordingly, the Advocate Law regulates attorney–client privilege for attorneys. According to Article 36 (Right to Keep Secrets), attorneys cannot disclose any document or information obtained while practising their profession. Similarly, Article 130/2 of the CPC sets out that any material seized as a part of a search conducted in an attorney's office must be returned immediately to the attorney if the material is understood to relate to the professional relationship between a client and that attorney. There are not any differences between an individual client and a corporation in that respect.

  1. Does the attorney–client privilege apply equally to in-house and external counsel in your country?

There are no specific provisions that define the application of attorney–client privilege to in-house and external counsel in Turkey. However, the Turkish Competition Board stated in its Dow decision that correspondence with an independent attorney falls within the scope of attorney–client privilege and shall be protected. In other words, in-house counsel employed by a corporation that is the subject of an investigation cannot enjoy attorney–client privilege.

  1. Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to (internal or external) investigations in your country?

Currently, there is no law or precedent touching on the level of privilege that a foreign lawyer will enjoy compared to a domestic one. Under the Turkish Constitution, attorney–client privilege is protected under the right to legal remedies. From the constitu- tional point of view, there should be no restriction to the attorney–client privilege between a client and a foreign attorney.

  1. To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

There are no regulations to guide us as to whether waiver of attorney–client privilege would be regarded as a co-operative step.

  1. Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

No, we do not have such a concept.

  1. If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

There are no rules or regulations in this respect.

  1. Do common interest privileges exist as concepts in your country? What are the requirements and scope?

There are no rules or regulations under Turkish law relating to common interest privileges.

  1. Can privilege be claimed over the assistance given by third parties to lawyers?

The principles of attorney–client privilege apply to the correspondence between attorney and client and not to assistance from third parties to lawyers.

Witness interviews

  1. Does your country permit the interviewing of witnesses as part of an internal investigation?

There are no rules preventing companies from interviewing witnesses as part of an internal investigation. However, obtaining consent from a witness would prevent any subsequent complaint from a criminal law or data privacy law perspective.

  1. Can a company claim attorney–client privilege over internal witness interviews or attorney reports?

There are no court cases or regulations about claiming privilege over attorney reports that are based on internal witness interviews. Therefore, good practice would be to assume privilege only when external counsel is taking notes during witness interviews or preparing attorney reports to establish a legal defence.

  1. When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

There are no legal or ethical requirements or guidance under Turkish law to consider when conducting a witness interview of an employee. The general principles and provisions about data privacy law, employment law and criminal law should be adhered to during interviews (note that the latter can be an issue when, for instance, a witness claims that his or her inter- view took place by force and his or her freedom was restricted, or that the interview was recorded without his or her consent).

  1. How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

There is no specific format or guidance for conducting an interview. Internal interviews are usually conducted in a Q&A format. In practice, documents might be shown to the inter- viewees as well. Witnesses may choose to attend the interviews with their counsel.

Reporting to the authorities

  1. Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

As stated in question 33, although its application in practice is quite rare, failure to report a crime at the very instant it is committed, or when it is still possible to limit its consequences, constitutes a crime that is punishable by imprisonment for up to one year under the CC. Other than that, there are no mandatory reporting obligations.

  1. In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Self-reporting should be assessed in each case by taking into account the real risks and strategy in the matter. It would be advisable to self-report if there is an imminent threat of external investigation.

  1. What are the practical steps you need to take to self-report to law enforcement in your country?

There is no guidance on any practical steps regarding self-reporting. When a corporation or individual decides to self-report, it would be advisable also to correctly determine the relevant law enforcement body. However, note that effective remorse is available for certain crimes (e.g., bribery under the CC).

Responding to the authorities

  1. In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

Every communication between a law enforcement authority and a company is made in writing. However, in practice, it is advisable to have good communications with a public prosecutor to better understand the claims and status of the investigation. Other than this, there is no mechanism for plea bargaining in Turkey.

  1. Are ongoing authority investigations subject to challenge before the courts?

The decision to initiate an investigation can be challenged under the procedural rules to which the authority is subject. For example, if a ministry initiates an investigation against a company, this administrative action can be challenged as per Law No. 2577 on Administrative Procedure.

  1. In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

It would be advisable to have a central supervision mechanism for cross-border investigations. The consistency of negotiation packages can be affected by disclosure limitations imposed on companies through legal requirements (e.g., data protection or blocking statutes).

  1. If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

There is no specific regulation regarding production of material in a different jurisdiction. The authorities co-operate with each other, and there are some reciprocity agreements between countries that enable a request to be recognised and enforced in another jurisdiction. However, note that, in practice, it is not always quick and easy to have effective co-operation because of bureaucracy.

  1. Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

Turkish authorities share information with foreign authorities through the existing bilateral and multilateral agreements on mutual legal assistance.

  1. Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

As explained in question 61, any documents produced for a court file are open to third parties unless the court grants a confidentiality decision on the file.

  1. How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

If compliance with a request made by an enforcement authority would violate the laws of another country, it would be advisable for that company to explain the reasons why it cannot provide the requested documentation or information to the local law enforcement authority.

  1. Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Please see question 11 regarding data protection rules as blocking statutes in Turkey.

  1. What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

In principle, any documents produced for a court file are open to third parties. If the relevant party submits its request for confidentiality about the material presented, it must give a legiti- mate reason for that request. In such a case, the court will assess whether there is legitimate and reasonable cause to ask for the material in question to be kept confidential.

Prosecution and penalties

  1. What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

As there is no criminal corporate liability, the directors, board members or representatives of a corporation may face judicial fines or imprisonment for misconduct, but the corporation itself cannot be sanctioned. Other than this, administrative or civil liability may arise for both the corporation and any individuals concerned, in connection with misconduct.

  1. Where there is a risk of a corporate's suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

Article 58 of Law No. 4734 on Public Procurement sets forth a suspension regime of one to two years for those who have been involved in, among other offences, collusive tendering or document forging. Moreover, Law No. 4734 sets forth that those who refrain from entering into a contract after procuring a tender will be suspended for between six months and a year. If the suspended company is an equity company, any shareholders owning more than half of its capital would also be affected by the suspension. If the suspended company owns more than half the capital of another company, that company would also be suspended accordingly.

  1. What do the authorities in your country take into account when fixing penalties?

Article 61 of the CC lists the factors that a criminal judge shall consider when fixing a penalty between the lower and upper limits for the offence at hand. Those factors are the way in which the offence was committed, how the damage occurred, the severity of the perpetrator's fault, and so on. Following that, Article 62 of the CC provides the following grounds for discretionary mitigation: the background and social relations of the perpetrator; the perpetra- tor's conduct after the act and during the proceedings; and the possible effects of the punish- ment on the perpetrator's future.

Resolution and settlements short of trial

  1. Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Neither non-prosecution agreements nor deferred prosecution agreements are available in Turkey. Although it does not have the same scope, one may note the following.

Pursuant to Article 171 of the CPC, offences prosecuted on complaint that are subject to a penalty of imprisonment for less than one year can be deferred by the prosecutor for five years. However, certain conditions must be met before the prosecutor can make this decision. Those conditions are that the accused should not previously have been sentenced to impris- onment based on an intentional crime; the investigation should indicate that the accused will not commit any crimes after a possible deferral decision; the deferral must be more beneficial to the accused and society than prosecution; and the damage suffered by the victim and the general public must be fully compensated. If the accused does not intentionally commit a crime during the deferral period, the prosecution will be dropped.

On the other hand, Article 253 of the CPC regulates reconciliation by mediation for certain offences. In this regard, the outcomes of the offence can be compensated between the accused and the private person or entity without proceeding with a prosecution. If the offence is subject to reconciliation, the prosecutor will initiate the procedure ex officio and present the file to the reconciliation bureau. If all the parties agree to proceed with reconcili- ation, the court will defer announcement of the verdict until the conditions agreed under reconciliation are met by the accused. If the accused violates the reconciliation agreement within this period, the court will announce the verdict.

  1. Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

With reference to our explanations regarding corporate liability under question 2 and non-prosecution agreements or deferred prosecution agreements under question 65, there is no such concept in Turkey.

  1. Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

In Turkish law, settlement with law enforcement authorities is subject to certain requirements and limitations in terms of scope. To exemplify, penalties arising from the offence of smug- gling are left out of the scope of settlement tax penalties or administrative fines. In terms of settlement for criminal liability, the possibility to settle is provided for offences, subject to a complaint by the victim, with some exceptions, such as the offence of fraud or the disclosure of business secrets, banking secrets or information relating to customers.

  1. To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

There is no such concept under Turkish law. However, it is possible under the CPC for the criminal court to appoint a custodian for the management of the corporation during the investigation or criminal proceedings if the court has serious doubt that a crime has been committed and it is necessary to shed light on the material facts. That being said, the role of such a custodian is not related to monitoring and compliance with laws, but rather to finan- cial management of the company.

  1. Are parallel private actions allowed? May private plaintiffs gain access to the authorities' files?

Under Turkish law, the authorities' files are considered to be in the public domain and this allows access to such files by private plaintiffs. However, similar access to confidential files may be restricted.

Publicity and reputational issues

  1. Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a

Article 157 of the CPC provides for the confidentiality of an investigation and Article 285 of the CC deems a breach of the confidentiality of an investigation to be an offence subject to imprisonment for between one and three years. Only the victim, the complainant and the lawyers of the parties are allowed to review the investigation file and take copies to the extent that confidentiality is maintained. After the criminal case is filed, the trials are open to the general public in principle. However, where public morality and security so requires, the court may opt for confidential conduct of a trial. Confidentiality of a trial when the accused is less than 18 years old is mandatory.

  1. What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

Generally, lawyers and public relations firms work together in managing corporate communi- cations. In sensitive cases that require communication with government bodies, in particular, lobbying firms may also take a role.

  1. How is publicity managed when there are ongoing related proceedings?

When such publicity is deemed necessary by the corporation, it is mostly managed by press statements.

Duty to the market

  1. Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

Mandatory disclosure in these circumstances may be required under the Law on Capital Markets, as described in question 35.

Anticipated developments

  1. Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

In March 2019, the OECD issued a notice to Turkey with regard to its continued failures to implement the key aspects of the OECD Anti-Bribery Convention and to enforce its foreign bribery laws. Under this notice, Turkey is criticised about not covering state-owned or state-controlled enterprises under the current corporate liability regime. Besides, sanc- tions applicable to legal persons are found to be insufficient and ineffective, along with the fact that imposing a sanction on a legal person is only possible when a real person is prosecuted or convicted. The OECD clearly invited Turkey to take the necessary action to address these deficiencies under the relevant legislation and, for that purpose, set a deadline of 19 October 2019. Although several notices have been given in the past, Turkey has failed to abide by such notices and take relevant action.

The insufficiency of sanctions applicable to legal persons and the fact that they are seldom used in practice are also issues that are subject to criticism by scholars. Therefore, there might now be an increased awareness of this topic and this latest OECD notice may help to trigger legislative activity.

First published by Global Investigation Review, in 03.02.2020

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.