October

Turkey's Data Protection Authority recently published the long-awaited draft of the Regulation on Deletion, Destruction and Anonymization of Personal Data.
 
The Draft Regulation outlines proposed details of requirements for data controllers, as well as definitions and exceptions. Notably, it proposes that if deleting personal data will lead to an inability to access and use other data in the system, the personal data will be deemed to have be deleted, provided other conditions are met.
 
The Draft Regulation also addresses internal procedures for data controllers to delete, destroy, or anonymize personal data. It proposes that data controllers that are subject to registry obligations be required to prepare a Personal Data Retention and Erasure Policy. Failure to delete or anonymize personal data could result in imprisonment for between one to two years.

The UK's proposed reduction of the Financial Conduct Authority's (FCA) register could lessen protections for small advice firms and consumers.
 
Among plans published to extend the senior managers regime to all regulated financial services firms were proposals that certified people within a firm would not need to be approved directly by the FCA. Former FCA technical specialist Rory Percival said the proposals would mean consumers had "One less step to protect themselves”, and "This may widen the scope for unauthorized advisers and scammers”.
 
ThreeSixty managing director Phil Young agreed that the absence of a public register could pose a risk for consumers seeking advice. "At the moment, having the FCA approving advisors acts as a bit of a firewall for those firms that do not do all the proper vetting," he said.

A regulatory regime intended to crack down on the behavior of bank bosses is to be extended to 47,000 firms in the UK, including dentists, gyms and tool hire companies that offer credit to customers.
 
The Financial Conduct Authority estimated that the new regime would cost firms £550m, with up to £190m of ongoing costs for the firms involved.
 
The regime originally was intended to hold bank executives accountable when their firms collapsed. It requires certification each year, including five "conduct" rules: act with integrity, act with due care, skill and diligence, be open and cooperative with regulators, pay due regard to customer interests and treat them fairly, and observe proper standards of market conduct.