KVKK (Turkish Data Protection Authority) — Employer (data controller, redacted)

Decided by

Kişisel Verileri Koruma Kurulu

Parties

— v. Veri sorumlusu

Decision date

August 4, 2022

Remedy

The data controller was ordered to pay an administrative fine of 500,000 TRY, cease processing biometric facial recognition data, destroy all existing facial recognition and verification records, implement alternative attendance tracking methods, adjust workplace camera positions, and update its privacy and consent documents within 30 days.

Amount

TRY 500,000

Appeal

Appeal status not stated

Key holdings

1. Using a facial recognition system for tracking employee entry and exit without meeting statutory conditions or valid explicit consent constitutes unlawful processing of biometric data under Article 6 of the Law.

   “yüz tanıma sistemi vasıtasıyla biyometrik verilerini işlenmesinin Kanun’un 6’ncı maddesi kapsamında herhangi bir veri işleme şartına dayanılmaksızın gerçekleştirildiği sonucuna varıldığı”

2. Failure to fulfill data security obligations to prevent unlawful data processing results in an administrative fine of 500,000 TRY under Article 18 of the Law.

   “Kanun’un 18’inci maddesinin (1) numaralı fıkrasının (b) bendi kapsamında 500.000 TL idari para cezası uygulanmasına”

3. Positioning cameras in workplace areas where employees have a reasonable expectation of privacy violates the principles of lawfulness and good faith.

   “kameraların veri sorumlusu tarafından çalışanların mahremiyet beklentilerini zedeleyecek şekilde konumlandırıldığı dikkate alındığında bu durumun Kanun’un Genel İlkeler başlıklı 4’üncü maddesinin”

4. Combining all personal data processing activities into a single text for obtaining consent invalidates the consent, as it deprives individuals of a clear choice and specific information.

   “veri sorumlusu tarafından ilgili kişilere imzalatılan açık rıza metninin Kanun’da kişisel verilerin işlenmesi şartı olarak yer alan açık rızanın unsurlarını taşımadığı”

In plain English

Employees of a paper production company filed complaints with the Turkish Data Protection Authority against their employer regarding privacy violations at the workplace. The employees alleged that the employer unlawfully processed their biometric data through a facial recognition system used for monitoring entrance and exit times, without obtaining valid explicit consent or providing separate privacy notices. They also complained that security cameras were placed in corridors near rest areas and restrooms, creating an intrusive environment that infringed on their privacy expectations. Upon investigation, the authority found that processing biometric facial data for shift tracking lacked a valid legal basis under data protection law because less intrusive alternatives were available. Furthermore, the explicit consent form collected by the employer failed to meet legal standards because it combined multiple processing purposes into one bundled agreement, undermining freely given consent. The authority also determined that positioning security cameras near private employee areas violated the core principles of lawfulness and good faith. Consequently, the authority imposed an administrative fine of 500,000 TRY on the employer for failing to take necessary technical and administrative measures to prevent unlawful data processing. Additionally, the authority ordered the employer to immediately stop processing biometric facial data, destroy all collected facial recognition data and verification records, adopt alternative non-biometric methods for tracking employee access, adjust camera positioning across the facility, and update both its privacy notices and explicit consent documents within 30 days.