Good News for Companies: KVKK Penalty Overturned by the AYM!
Official titleDecision of the Constitutional Court Dated 27/1/2026 and Application Number 2020/32193
The Constitutional Court has decided that punishing the use of publicized personal data for marketing purposes with an administrative fine violates the principle of "legality of crimes and punishments".
Details of the Regulation
The decision concerns the administrative fine imposed by the Personal Data Protection Authority (KVKK) on Viennalife Emeklilik ve Hayat A.Ş. after the company used a complainant's phone number, which was publicly available on the website "hizmetburada.com", for a marketing call without their explicit consent. The company argued that the data was already publicized by the data subject and, pursuant to Article 5 of the KVKK Law, could be processed without seeking explicit consent.
The KVKK and the Peace Criminal Judgeship, on the other hand, affirmed the penalty by stating that publicized data can only be used in accordance with the purpose of publicization, and that its use for marketing purposes is unlawful. In its examination, the Constitutional Court emphasized that there is no clear, predictable, and explicit legal regulation in the law stating that "use contrary to the purpose of publicization" shall be punished with an administrative fine.
Stating that administrative fines also fall within the scope of the principle of legality of crimes and punishments, the Court unanimously decided that imposing a penalty by interpreting the provision of the law in an unpredictable and broad manner violates Article 38 of the Constitution, and ruled for a retrial to remedy the violation.
Questions You Might Have
- If I shared my personal data on the internet myself, can companies call me for any purpose?
- No, under personal data protection law, use contrary to the purpose of publicization is normally prohibited. However, this decision states that this boundary is not clearly defined in the law regarding its penal sanction dimension, and therefore a fine cannot be imposed; meaning the legislation needs to be clarified.
- Will administrative fines received by companies be canceled after this decision?
- This decision does not directly cancel all fines, but it sets a precedent for penalties arising from similar legal gaps. In the case subject to the lawsuit, the court ruled for a retrial, paving the way for the cancellation of the fine imposed on the company.
- Were there any AYM members who cast a dissenting vote?
- No, the decision was taken unanimously (with the joint decision of all members) by the General Assembly of the Constitutional Court.
Key Terms
- Suçta ve Cezada Kanunilik İlkesi
- The universal principle of law stipulating that individuals cannot be punished for an act that the law does not explicitly classify as an offense or misdemeanor.
- Alenileştirme
- The situation where personal data is presented to the knowledge of the public or made accessible to the public by the data subject themselves.
- Veri Sorumlusu
- The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.
Where we posted this
Follow Turkish legal developments
REGAS analyzed all 42 items in the Official Gazette of 16 June 2026; we published only 5 of them here.
REGAS summarizes every change in the Turkish Official Gazette in plain language and notifies you.
The REGAS app is currently Turkish-only. If you would like English in the app, the best way to make it happen is to support the developer: get the app and just say so.
REGAS Commentary
This decision provides a very important protection for companies processing personal data and for data controllers. It has been certified that the exorbitant administrative fines imposed by the KVKK through a broad interpretation of limitations not explicitly written in the law (for instance, restrictions in the law regarding the purpose of use of publicized data that are not clear) are contrary to the Constitution. As for citizens, although it is desired to prevent marketing calls made by contacting their personal data without their consent, it has been reminded that sanctions must remain within the limits of legal predictability.