KVKK (Turkish Data Protection Authority) — Gym / sports-facility operator (redacted)
KVKK fined a gym operator TRY 225,000 for processing members' biometric data (palm/fingerprint) for entry-exit control in violation of proportionality, and ordered it to cease processing and destroy the biometric data.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the decision on 2026-09-19. Every holding carries a short verbatim quote from that text (in TR, the document's language).
- Decided by
- Kişisel Verileri Koruma Kurulu
- Parties
- Kişisel Verileri Koruma Kurulu v. Spor salonu hizmeti sunan şirket
- Decision date
- February 27, 2020
- Remedy
- The Turkish Data Protection Board imposed an administrative fine of 225,000 TL on the sports facility operator, ordered the immediate destruction of all collected biometric data, instructed the operator to halt biometric processing for access controls, and ordered updates to its privacy notice.
- Amount
- TRY 225,000
- Appeal
- Appeal status not stated
Key holdings
Using biometric scanning such as palm or fingerprint systems for gym access violates the principle of proportionality under Turkish data protection law, even if optional card access is offered or consent is obtained.
“biyometrik veri içeren bir sistemin tesis giriş ve çıkışlarında kullanılmasının Kanunun “Genel İlkeler” başlıklı 4 üncü maddesinin (2) numaralı fıkrasının (ç) bendindeki ölçülülük ilkesine aykırı olduğu”
The authority imposed an administrative fine of 225,000 TL on the data controller for failing to ensure data security under Article 12 of Law No. 6698.
“Kanunun 18 inci maddesinin (1) numaralı fıkrasının (b) bendi kapsamında veri sorumlusu hakkında 225.000 TL idari para cezası uygulanmasına”
In plain English
The Kişisel Verileri Koruma Kurulu investigated a complaint against a sports facility operator processing biometric data, specifically hand, finger, and palm scans, for member entry and exit verification. Members raised concerns regarding the security and necessity of collecting such special category personal data. The authority concluded that scanning palm or fingerprints constitutes biometric data processing. Although the operator argued that members were offered an alternative option to enter by presenting a card, the authority held that utilizing a biometric system for access control violates the core principle of proportionality set out in Article 4 of Law No. 6698. The board emphasized that explicit consent from data subjects does not legitimize processing excessive data when less intrusive methods are sufficient. Consequently, the facility operator violated data protection obligations under Article 12 of Law No. 6698. Pursuant to Article 18 of Law No. 6698, the board imposed an administrative fine of 225,000 TL. Additionally, the board ordered the operator to immediately destroy all collected biometric data under Article 7 and related regulations, stop collecting biometric data for access control, update its privacy notice, and provide documentation confirming the deletion of complainant personal data.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.