- General Overview
Article 18 of the Personal Data Protection Law regulates administrative fines for various offenses, such as failure to fulfill the obligation of clarification by data controllers, failure to meet data security obligations, failure to comply with decisions made by the Personal Data Protection Board, failure to register in the Data Controllers Registry, and failure to notify authorities. The fines range from 5,000 Turkish liras to 100,000 Turkish liras for data controllers who fail to meet the clarification obligation, from 15,000 Turkish liras to 1,000,000 Turkish liras for those who fail to meet data security obligations, from 25,000 Turkish liras to 1,000,000 Turkish liras for those who do not comply with Board decisions, and from 20,000 Turkish liras to 1,000,000 Turkish liras for those who violate registration and notification obligations. It is observed that there is a significant gap between the minimum and maximum limits of administrative fines. In determining the amount of the fine, the nature of the offense, the economic condition of the data controller, and the degree of fault will be taken into account. According to Article 17 of the Misdemeanors Law, 75% of the administrative fine must be collected from the person before appealing the decision. Prepayment will not affect the right to appeal this decision. If the data controller is economically unable to pay the fine, the first installment of the fine may be paid in advance, and the remaining balance may be paid in four equal installments within one year. If the installments are not paid on time or fully, the remainder of the fine will be collected in full.
- Legal Remedies Against Sanctions
Administrative fines imposed by the Personal Data Protection Authority (KVK) are subject to judicial review, in accordance with Article 125 of the Turkish Constitution, which states that “the administration’s actions and procedures are open to judicial review.” There is no doubt that administrative sanctions are subject to judicial review; however, whether the review will occur in administrative courts or in the judiciary is an important issue. The draft law related to Law No. 6698 included a provision in Article 18, paragraph 4, stating that “those concerned may file a lawsuit in administrative courts against the administrative sanctions decisions issued by the Board,” but this paragraph was removed from the draft law by the sub-commission. The reason for the removal was stated as: “The fourth paragraph of Article 18 of the draft was removed in order to abandon the procedure of filing lawsuits in administrative courts regarding the administrative sanctions for the offenses regulated in this article, and to apply the procedure outlined in Law No. 5326, which was enacted on March 30, 2005, regarding administrative sanctions.”
The General Law provision in Article 3 of Law No. 5326, titled “General Provisions,” states: “(1) The provisions of this law; a) Regarding the judicial review of administrative sanction decisions, will apply in the absence of contrary provisions in other laws, b) The other general provisions will apply to all acts requiring administrative fines or public confiscation, unless stated otherwise.” There is no special provision in the Personal Data Protection Law (KVKK) regarding the judicial review of administrative sanctions in administrative courts. Therefore, the judicial review will be carried out in the judiciary according to the procedure and principles set forth in Law No. 5326. Article 27, paragraph 1, of Law No. 5326 states: “(1) Against administrative sanctions related to fines and the confiscation of property to the public, an application may be made to the Peace Penal Court within fifteen days from the date of notification or acknowledgment of the decision. If no application is made within this period, the administrative sanction decision becomes final.”
With the addition of Additional Article 1 to the Law on the Implementation of the Criminal Procedure Code (Law No. 5320), Peace Penal Courts are authorized to review such cases. However, in cases where both administrative and judicial decisions are made regarding the same individual, and these decisions fall under the jurisdiction of administrative courts, any claims of illegality regarding the administrative sanction decision will be reviewed in the administrative court along with the request for the annulment of the relevant act. For example, if the decision to revoke a driving license is made along with an administrative fine, the administrative court will be responsible for the review of the case.
Furthermore, in cases where an administrative fine is not final and a payment order is issued for the collection of the fine, the annulment of this payment order can be sought in the administrative courts.
Attorney Yalçın TORUN
[1] Council of State, 15th Chamber, 2015/7832 E and 2016/217 K Decision: “In disputes arising from traffic administrative fines, the competent court is the Peace Penal Court according to Article 27/1 of Law No. 5326. However, in the case of disputes arising from administrative acts such as the revocation of a driver’s license, the competent courts are the administrative courts, not the peace penal courts. According to the regulation in Article 27/8 of Law No. 5326, if administrative acts affecting the same person are made within the scope of the administrative sanction, the claims of illegality will be reviewed in the administrative courts, and the case should be considered by the administrative court, not the peace penal court.”
[2] Council of State, 8th Chamber, 2014/1807 E and 2014/6582 K Decision.
© 2025 Torun Law Firm – All Rights Reserved.
This article is protected under the provisions of the Law on Intellectual and Artistic Works (No. 5846). The content, in whole or in part, may not be copied, reproduced, published, or shared on any other website without the prior written permission of the author and Torun Law Firm.
This material may only be shared by licensed attorneys, for professional purposes, without any modifications, and with full attribution to the author and the source.
Any unauthorized use may result in legal and criminal liability.