A Constitutional Court Decision Regarding an Administrative Fine Imposed Under the KVKK Has Been Published

The Constitutional Court’s decision dated 27 January 2026 and numbered 2020/32193 concerning the application of Viennalife Emeklilik ve Hayat A.Ş. was published in the Official Gazette dated 16 June 2026 and numbered 33282.

In its decision, the Constitutional Court held that the principle of legality of crimes and punishments had been violated with respect to the administrative fine imposed within the scope of the obligation to prevent the unlawful processing of personal data.

The key points of the decision are summarized below:

• In the incident giving rise to the application, the data subject filed a complaint with the Personal Data Protection Authority, alleging that they had been contacted by the applicant company to discuss insurance services and arrange an appointment, and that their personal data had been obtained and used without their explicit consent. 
• The applicant company argued that the data subject’s name, surname, and telephone number had been obtained from the website hizmetburada.com and that such information had been made publicly available by the data subject. 
• The Personal Data Protection Board (Board) considered that the presence of the data subject’s contact information on a website did not mean that such data could be used for commercial communication purposes. The Board further stated that personal data made public may only be processed in a manner compatible with the purpose for which they were made public. 
• Accordingly, the Board decided to impose an administrative fine on the applicant company on the grounds that it had failed to take the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of personal data. 
• Although the Constitutional Court acknowledged that the applicant company had been sanctioned on the basis of a law in the formal sense, it further examined whether that legal basis met the requirements of clarity and foreseeability under the principle of legality. 
• The Court noted that the Personal Data Protection Law No. 6698 (KVKK) contains no explicit provision regarding the purpose of making personal data public or providing for sanctions where personal data are used contrary to that purpose. The Court also considered that neither the applicant company’s responsibility in its capacity as a data controller nor the reasons why its data processing activity had been deemed unlawful had been established with sufficient clarity. 
• Considering these assessments, the Constitutional Court concluded that the administrative fine imposed on the applicant company resulted from an unforeseeably broad interpretation of the statutory provision. Accordingly, it held that the principle of legality of crimes and punishments had been violated and ruled that a retrial should be conducted.

The decision indicates that, in the context of administrative sanctions imposed in the field of personal data protection, both the legal basis of the obligation alleged to have been breached, and the corresponding sanction must be clearly and foreseeably established in relation to the specific circumstances of the case.