Constitutional Court Curbs The Personal Data Protection Board’s Authority: Law Takes Precedence Over Guidelines

The Constitutional Court held that the principle of legality was violated in the administrative fine imposed on an insurance company by the Personal Data Protection Board. The Court clarified that the Board cannot rely on its interpretation of the “purpose of making data public” as a basis for sanctions without a clear legal ground. The decision indicates that companies processing data from publicly available sources should reassess their processes, inventories and ongoing investigation files under Article 5 of the Personal Data Protection Law.