CONSTITUTIONAL COURT DECISION ON THE PROCESSING OF PUBLICLY DISCLOSED PERSONAL DATA

The Constitutional Court’s (“Court”) decision finding a violation of the principle of legality of crimes and punishments with respect to an administrative fine imposed for the use of publicly disclosed personal data was published in the Official Gazette dated 16 June 2026 and numbered 33282.

Summary of the Case

A person filed a complaint alleging that, despite having no prior customer relationship with the insurance company, they had been contacted by phone and informed about insurance products, and that their personal data had been obtained without their explicit consent.

In its defence, the company argued that the data subject’s phone number and other contact details had been obtained from a website that was publicly accessible on the internet, that such information had been made publicly available by the data subject, and therefore constituted publicly disclosed personal data. In this context, the company maintained that, since the data subject had personally made the relevant personal data public, the processing of such data without obtaining explicit consent was lawful pursuant to the Personal Data Protection Law (“Law”).

The Board’s Approach

While assessing the provision of the Law relied upon by the company, the Personal Data Protection Board (“Board”) emphasized that the fact that a data subject has made their personal data public does not mean that such data may be processed for any purpose whatsoever. In this regard, the Board stated that the presence of a phone number on the internet does not automatically imply that the data may be used for commercial purposes, and that the fact that contact information has been made publicly available for a specific purpose does not render its use for different purposes lawful.

The Board further stated that the publication of an individual’s contact details on the internet cannot be regarded as an expression of intent permitting the use of such information for marketing purposes. It emphasized that publicly disclosed personal data may only be processed to the extent that such processing is related to, and limited by, the purpose for which the data was made public by the data subject.

The Board imposed an administrative fine of TRY 100,000 on the company on the grounds that it had processed personal data unlawfully. Upon the company’s objection, the Criminal Judgeship of Peace made a correction only to the amount of the fine and dismissed the objections concerning the merits of the sanction. Subsequently, the company lodged an individual application before the Constitutional Court, alleging a violation of the principle of legality in crimes and punishments.

The Constitutional Court’s Assessment

The Court first emphasized that administrative fines must also be assessed in light of the principle of legality of crimes and punishments under Article 38 of the Constitution. Accordingly, not only criminal offences but also misdemeanours and the administrative sanctions imposed in relation to them must have a clear legal basis. The ability of individuals to foresee in advance which conduct may give rise to a sanction and to be protected against arbitrary interpretations by the administration constitutes a fundamental requirement of the rule of law. For this reason, the Court stated that the rules forming the basis for the imposition of sanctions must be accessible, precise, and foreseeable.

The Court then examined the statutory framework applicable to the case. Article 5/2(d) of the Law provides that personal data which has been made public by the data subject may be processed. However, the Court noted that the provision does not expressly state that such data may only be processed “in connection with the purpose for which it was made public.” According to the Court, the principal basis for the administrative fine imposed on the company was the Board’s finding that, although the data had been made public by the data subject, it had been used for purposes unrelated to the purpose of disclosure. The Court observed, however, that this criterion does not derive directly from the wording of the Law, but rather stems from the Board’s interpretation and the guidance documents issued by the Authority.

The Court held that the Board’s interpretation could not be derived as a natural consequence from the wording of the Law and that relying on a criterion which is not expressly provided for in the Law and whose scope and limits have not been clearly defined, by subsequently developing it through interpretation and using it as the basis for an administrative fine, undermines the safeguards afforded by the principle of legality. In this context, the Court did not assess whether the Board’s interpretation was substantively correct; rather, it examined whether that interpretation had a sufficiently clear and foreseeable legal basis capable of justifying the imposition of a sanction. Consequently, the Court concluded that transforming a restriction not expressly set out in the Law into a binding obligation for data controllers through Board guidelines or administrative interpretations, and imposing an administrative fine for the breach of such an obligation, is incompatible with the principle of legality of crimes and punishments.

Another point emphasized by the Court concerns the applicant company’s legal position in the data processing process. Although the Board regarded the company as the data controller processing the data and directly subjected it to an administrative sanction, the Court stated that the company’s defence — namely that it had not made the data public itself and had obtained it from an internet source created by third parties — had not been sufficiently examined. According to the Court, the manner in which the data was obtained, how the data flow occurred, and the company’s role and responsibility in this process should have been established in greater detail in light of the specific circumstances of the case.

Conclusion

The Court declared the application admissible and concluded that the principle of legality of crimes and punishments, as guaranteed under Article 38 of the Constitution, had been violated in relation to the administrative sanction imposed on the company. In order to remedy the consequences of the violation, the Court ordered that the case file be remitted to the Istanbul Anatolian 5th Criminal Judgeship of Peace for retrial. The Court also awarded the applicant company its litigation costs and legal fees.

Please let us know if you have any queries.