Judicial Review of Board Decisions

Pursuant to the Law, the Board has the authority to impose administrative sanctions. It has been regulated that the Board may impose administrative fines for non-compliance with the obligation of disclosure, obligations related to data security, failure to comply with the decisions issued by the Board, violations of the obligation to register and notify the Data Controllers’ Registry, or non-compliance with the notification obligation regarding standard contracts. In addition to imposing administrative fines, the Board may also decide to order the data controller to eliminate the breach and to suspend data processing and transfer as an administrative action.

Within the systematics of the Law, administrative fines to be imposed by the Board are regulated under the title “Misdemeanors”. Accordingly, within the framework of the revaluation rate regulated under Article 298 (repeated) of Tax Procedure Law No. 213, the administrative fines specified in the relevant articles of the Law will be applied as follows in 2025:

On the other hand, prior to the amendments, the Law did not provide any avenues for challenging administrative fines and sanctions imposed by the Board, and this issue was not regulated within the Law. In practice, since violations that result in administrative fines were classified as "misdemeanors," the legal avenues for appealing these sanctions were based on the Misdemeanor Law No. 5326. As a result, lawsuits against these administrative fines were typically brought before Criminal Courts of Peace, which were considered to have jurisdiction in such cases. In response to this situation, practitioners have long criticized that, given the highly technical and specialized nature of personal data protection, the Criminal Courts of Peace, which are primarily focused on criminal law, are not the appropriate authority for the judicial review of decisions made by the Board. It has been observed that decisions made by the Criminal Courts of Peace are often superficial and lack legal justification, and this has led to the view that such decisions cause rights violations for individuals. On the other hand, the fact that appeals against decisions made by Criminal Courts of Peace are reviewed by another criminal peace court has resulted in these decisions becoming final without undergoing review by a higher court, thus hindering the creation of case law in the field of personal data protection law.

When the judicial review process conducted by the Criminal Courts of Peace, which are first-instance courts, is completed with the finalization of the decision through a simplified trial procedure, the only available avenue for higher court review is to appeal directly to the Constitutional Court. Indeed, in a recent decision, the Constitutional Court determined that the judicial process concerning the administrative fine imposed by the Board on a data controller for violating its obligations to ensure data security led to a violation of the right to property. In its ruling, the Constitutional Court emphasized that administrative fines constitute an interference with the right to property. Therefore, it concluded that, when interfering with property rights, the general principles governing the limitation of fundamental rights and freedoms under Article 13 of the Constitution must be taken into account, and the interference must comply with the principle of proportionality. Under the principle of proportionality, it was stated that interventions should be proportionate and that it is of great importance for a court to effectively examine claims of unlawfulness in terms of the proportionality of the intervention. Ultimately, the Constitutional Court ruled that the judicial review carried out by the Criminal Courts of Peace did not include any assessment within the framework of the objections made by the appealing party. Therefore, it was found that the safeguards for the protection of the right to property under the right to a fair trial were not fulfilled, leading to a violation of the right to property.

As highlighted by the Constitutional Court's decision, it is of great importance for a court to effectively examine claims of unlawfulness in ensuring the proportionality of interventions made to fundamental rights and freedoms.

The findings regarding the difficulties in the judicial process against the administrative fines imposed by the Board, the criticisms raised, and the Constitutional Court's decision have demonstrated that the Criminal Courts of Peace are not the appropriate authority for judicial review in the field of personal data protection. With the publication of the Human Rights Action Plan by the Ministry of Justice, it was announced that the Law would be aligned with European Union standards, and individuals would have the option to appeal the Board's administrative fines to administrative courts instead of Criminal Courts of Peace.

With the Amendment Law, a clear regulation has been introduced as a solution to these issues, allowing administrative lawsuits to be filed against the Board’s administrative fines in administrative courts. In this way, it has been explicitly regulated that the administrative fines imposed by the Board, being administrative acts, will be subject to administrative judicial review, thereby eliminating uncertainties in practice and establishing a procedure that will enable more effective oversight of the Board’s decisions. With this amendment, it is expected that the legal certainty issues experienced in the pre-amendment period will decrease and that jurisprudence providing guidance for practice will increase.

With the Amendment Law coming into force on June 1, 2024, a transitional provision has been introduced, stipulating that applications already pending before the Criminal Courts of Peace before the effective date will continue to be handled by these courts.

According to this transitional provision, cases that are still ongoing before the criminal judgeships of peace as of June 1, 2024, will be finalised by these courts. However, lawsuits filed after June 1, 2024, will be heard before administrative courts.

Although the temporal application of the Law has been determined through the amendments and the added transitional provision, the other transitional provisions—particularly those concerning the cross-border transfer of personal data, which allow the continuation of the previous practice until 01.09.2024—have raised questions regarding the temporal application of the Law in practice.

In order to eliminate these uncertainties, the Authority published an informational note on 19.12.2024 to serve as a guide for implementation. It emphasized that the provisions regarding temporal application in the Turkish Criminal Law No. 5237 would be taken into account.

Within this framework, the administrative sanction decision to be applied will be determined based on the principles of the Turkish Criminal Law, considering the time of the offence and the time of the complaint. Accordingly;

• In cases where the act was committed and completed before the legislative amendment:
  • In cases where the act was committed and completed before the legislative amendment, regardless of when the complaint was filed, if the decision to be issued as a result of the trial is made after the Effective Date of the Amendment Law, the more favorable law will be applied.
• In cases where the act began before the legislative amendment and is still ongoing (continuous acts – ongoing violations);
  • If the act was ceased before the legislative amendment, the law that is more favorable to the offender will be applied and,
  • If the act continues and ceases after the legislative amendment, the new law enacted after the amendment will be applied.
• If the act occurred after the legislative amendment:
  • In such cases, no issue regarding the temporal application of the law will arise, and the new law will be applied.

First published by Gün + Partners in Mar 04, 2025.