Decision affecting employees: Fingerprint-based attendance tracking found unlawful

The Personal Data Protection Board (KVKK) has issued a new principle decision that has sparked debate over the practice of monitoring employees' entry and exit times in workplaces using biometric data. Regulations have been introduced regarding the use of increasingly common technologies such as fingerprint, facial recognition, retina, and iris scanning, and it has been stated that these methods are unlawful for personnel tracking.

In the Board's assessment, biometric data is defined as "special category personal data," and it is noted that the processing of this information carries irreversible risks. It was emphasized that having a legal basis for using such data is not sufficient on its own, and that the principles of necessity, data minimization, and proportionality must also be observed.

Although employers are currently obligated to track their employees' working hours, the KVKK statement expressed that there is no explicit provision in the Labor Law requiring this tracking to be done specifically through biometric means. For this reason, it was deemed legally inappropriate for employers to conduct attendance control using biometric methods.

Furthermore, it was pointed out that due to the power imbalance between the employee and the employer, it is a matter of debate whether the explicit consent obtained from employees is truly based on "free will." The decision text also highlighted that the potential consequences an employee might face if they do not provide consent or withdraw their consent could negatively affect the validity of that explicit consent.

As an alternative, it was noted that less intrusive methods for tracking entry and exit, such as magnetic or RFID cards, encrypted cards, PIN codes, signature sheets, or records kept via a supervisor, could be preferred. The KVKK concluded that biometric systems cannot be mandatory, noting that these alternatives are more in line with the principles of proportionality and necessity.

The decision also stated that data controllers, i.e., employers, are obligated to take both technical and administrative measures to ensure that personal data is processed accurately and in accordance with the law. It was announced that the principle decision has been published in the Official Gazette and on the institution's website.

With this new regulation, the use of biometric data in workplaces has been largely restricted in order to protect the privacy of employees.