Judicial Remedy Against Decisions Issued By Turkish Data Protection Board

Under the Personal Data Protection Law No. 6698 Article 18 ("DPL") the Personal Data Protection Board ("Board") has the authority to impose administrative fines on data controllers due to failure to comply with their various obligations regulated under the DPL, i.e. failure to comply with the obligation to inform data subjects, obligations related to data security, the decisions issued by the Board and registration and notification obligations to the Data Controllers' Registry. However, there is no explicit provision under the DPL about the competent courts for judicial review of decisions of the Board imposing administrative fines which creates confusion and dissatisfaction in practice with regard to the judicial remedies to be followed.