The Constitutional Court Finds that the Dismissal of the Objection Made Before the Criminal Judgeship of Peace Against the Administrative Fine Imposed by the Personal Data Protection Board Violated the Property Right due to Insufficient Examination

The Constitutional Court, with its decision dated 12.10.2023 and application number 2020/7518 published in the Official Gazette on 15.12.2023, ruled that the decision of the Criminal Judgeship of Peace as to dismissal of the objection without conducting adequate examination regarding the objections of the applicant raised against the decision (“Board Decision”) of the Personal Data Protection Board (“Board“) and providing reasoning, violated the property right guaranteed by article 35 of the Constitution.

It was reported that the applicant had unauthorized access to the customer reservation database of the company it acquired in 2016, and this unauthorized access was detected in 2018. Subsequently, the Board decided to impose a total administrative fine of TRY 1,450,000 on the applicant on the grounds that the necessary technical and administrative measures for ensuring data security were not taken and the obligation to report the violation as soon as possible was not complied with.

The applicant objected to the Board Decision before the Criminal Judgeship of Peace on the grounds that,

  • The Board Decision lacks of lack of requisite and sufficient grounds and it was not duly notified to the applicant,
  • Due to the Law on Protection of Personal Data numbered 6698 (“Law”) being applied to events hitherto the effective date of the Law, the Board Decision cannot be enforced in terms of time,
  • Due to the fact that the applicant cannot be considered data controller, the addressee of the administrative fine was designated incorrectly, and this situation is contrary to the principle of individuality,
  • In absence of the Board decision as to the timeline for the notification of personal data breach (i.e., the Board Decision as to the Procedures and Principles on the Notification of Personal Data Breach dated 24.01.2019, numbered 2019/10), and the ambiguity in the legislation regarding this timeline (i.e., Article 12 of the Law) was interpreted to the detriment of the applicant although it had notified the Board in due time,
  • The fine imposed on the applicant was unlawful, despite all the precautions taken and the non-existence of fault of the applicant,
  • The fine violated the principles of proportionality mainly because it was imposed at the highest limit.

Upon the dismissal of the objection against the decision of the Criminal Judgeship of Peace, the objection against to this was dismissed as well. Thereafter the Constitutional Court examined the individual application at hand within the framework of the provisions of the Law and the GDPR, the property right as well as the principle of proportionality, and ruled that dismissal of the objection by the Criminal Judgeship of Peace without evaluating the above-mentioned grounds of objections and providing any reasoning violated the property right.