As per Article 22 of the Law on the Protection of Personal Data Numbered 6698 ("Law"), the Personal Data Protection Board is authorized to decide on administrative sanctions stipulated in the Law. As a manifestation of the principle of recourse to judicial review shall be available against all actions and acts of administration , decisions of the Board are subject to judicial review.
A. TYPES OF SANCTIONS
- Administrative Fines
According to Article 27 of the Misdemeanor Law, , an application can be made for administrative fines to the criminal court of peace of the place where the misdemeanor was committed or the place where the victim is located, within fifteen days at the latest from the date of notification or annotation of the decision regarding administrative fine. In other words, if natural or private law legal persons who have been imposed with an administrative fine by the Board, intents recourse to judicial review against the decision, they must apply to the Criminal Court of Peace within fifteen days from the notification of the fine. Decisions made upon application against administrative fines of less than three thousand Turkish Liras are final. In penalties exceeding the limit of three thousand Turkish Liras, an objection can be filed against the final decision of the court. This objection is made to the Criminal Court of Peace within seven days from the date of notification of the decision.
- Other Administrative Sanctions
If another sanction decision has been made together with the administrative fine, the competent court will be the Administrative Court. For instance, if it is decided to stop the transfer of data abroad under paragraph 7 of Article 15 of the Law, together with a fine, a lawsuit must be filed in the Administrative Court for the cancellation of the administrative action and the administrative fine. The competent court is Ankara Administrative Courts, where the Personal Data Protection Authority is located, the period for filing a lawsuit is 60 days and this period shall commence from the day following the written notification. In the lawsuit filed, the court will examine the compliance of elements of an administrative act: authority, form, reason, subject, and purpose. Besides of the administrative fine, a lawsuit should be filed in the Administrative Court against the decisions of other administrative sanctions imposed separately.
- Regarding Other Decisions of the Board
For applications where the authorization of the Personal Data Protection Board is required within the scope of Article 9 of the Law, a lawsuit can be filed in the Administrative Courts for the annulment of the rejection decision, since the decision regarding the rejection of the request for permission by the Personal Data Protection Board is an administrative act.
A lawsuit can be filed in Administrative Courts for the rejection of the application made as per the Article 15 of the Law, to the Personal Data Protection Board, by giving a negative answer or by failing to answer the application for 60 days, or for the annulment of the decisions that there is no violation as a result of the examination carried out ex officio by the Personal Data Protection Board.
B. MATTERS TO BE CONSIDERED WHILE FOLLOWING THE OBJECTION PROCESS
While examining the data controllers, the Authority also inspects the compliance of the data controller with the Law in general. Authority does not only conduct a relative examination of the event subject to the complaint, but also examines the obligations of the data controller under the Law. Therefore, firstly, an internal examination should be conducted regarding the compliance of the data controller with the Law and the compliance rate should be used in the objection process. While examining, courts examine the compliance of the data controller under the Law. In consequence of this examination, reductions can be made in Administrative Fines on the grounds that amount of fines highly exceeds the lower limit.
The Authority does not have a method for calculating administrative fines similar to the calculations in the " Guidelines 04/2022 on the Calculation of Administrative Fines Under the GDPR" of the European Data Protection Therefore, judicial review is carried out according to the thresholds of whether the duties under the Law are fulfilled.
However, since Judiciary has no specialization related to this matter, it collaborates with Experts on technical issues. Experts are generally appointed among Computer Engineers and Software Developers. It should be noted here that if there is a technical violation, it will be beneficial to the data controller to obtain a detailed Party Expert Report ("Opinion") regarding this violation and submit it to the court.
In addition, during the objection period, the former decisions of the Authority should be well screened and the comments made in favor of the party in Authority's decisions and the issues considered to be disproportionate in the administrative fines imposed by the Authority should be submitted in the objection petitions.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
