Constitutional Court Decision on Administrative Sanctions under Data Protection Law

The decision of the Constitutional Court (“Court”) dated 27 January 2026 and numbered 2020/32193 (“Decision”) was published in the Official Gazette dated 16 June 2026 and numbered 33282.

In the Decision, the Court examined the administrative fine imposed by the Personal Data Protection Board (“Board”) within the scope of the Personal Data Protection Law numbered 6698 (“Law”), from the perspective of the principle of legality in crimes and punishments guaranteed in Article 38 of the Constitution. In this regard, the Court emphasized that, concerning administrative sanctions, the obligation alleged to have been violated, and the sanction attached to it must rely on an explicit, clear, and foreseeable statutory basis.

In the case subject to the Decision, an administrative fine was imposed by the Board upon the applicant company for using contact information, which was publicly available on the internet, for marketing insurance services. The applicant company argued that the data subject's contact information was obtained from a public website and therefore constituted publicly available data within the scope of Article 5/2-d of Law No. 6698. Conversely, the Board evaluated that publicly available personal data can only be processed in a manner compatible with its purpose of public disclosure; thus, it found the use of the said data for marketing purposes to be unlawful and decided to impose an administrative fine on the applicant company.

In the evaluation made by the Court, it was stated that while the Law regulates that publicly available personal data may be processed without seeking explicit consent, there is no explicit, clear, and foreseeable statutory regulation indicating that an administrative fine will be imposed in the event of use contrary to the purpose of public disclosure. In this regard, the Court concluded that expanding an obligation which is not explicitly foreseen by the Law and has ambiguous boundaries through guides and administrative interpretations to serve as a basis for an administrative fine is incompatible with the principle of legality in crimes and punishments.

In this regard, the Decision holds significant importance in demonstrating that the Board’s previous approach regarding the processing of publicly available personal data cannot be applied in a manner that creates a new obligation or field of sanction not explicitly foreseen by the Law. While the Court acknowledges that the Board's decisions and guides can serve a guiding function in practice, it establishes that these cannot override the explicit regulation of the Law, and underlines that, in accordance with the principle of legality, administrative sanctions can only rely on an explicit, clear, and foreseeable statutory basis.

You may access the Decision here.