KVKK announcement on attendance tracking: Fingerprint and palm data are considered biometric data

The Personal Data Protection Authority (KVKK) has issued a public announcement regarding its previously published principle decision on the processing of biometric data for employee attendance tracking purposes. The announcement noted that data controllers from various sectors have submitted requests for opinions regarding the decision, which was published in the Official Gazette on June 2.

The KVKK reminded that under the Personal Data Protection Law No. 6698, biometric data is classified as special category personal data. The Authority also reported that the Population Services Law No. 5490 defines data unique to an individual obtained from fingerprints, vein patterns, and palm prints as biometric data collected for identification and verification purposes.

The announcement also responded to assessments suggesting that data obtained through methods such as palm scanning or fingerprinting should not be considered biometric data. The KVKK emphasized that data made suitable for uniquely identifying or verifying an individual through specific technical methods carries the nature of biometric data.

The Authority stated that converting such data into a mathematical code and storing it in a database does not negate its nature as biometric data. Thus, it was stated that fingerprint, palm print, or similar systems used for attendance tracking must be evaluated within the scope of the principle decision.

The KVKK pointed out that certain facilities and operational areas may be distinguished from general assessments in terms of security risks and the consequences of potential data breaches. However, it was noted that biometric data processing activities in these areas must also be limited to necessary critical areas and individuals, and must be proportionate and appropriate for the purpose.

The announcement emphasized that the principle decision relates only to biometric data processing activities carried out for the purpose of employee attendance tracking. For biometric data processing processes outside of attendance tracking, it was reported that the assessment of compliance with the law will be conducted by data controllers, taking into account the purpose of data processing, the nature of the work, and the specific circumstances of the case.

The KVKK announced that the Personal Data Protection Board will evaluate each specific case separately in the event of reports or complaints reaching the Authority.

News Source: 12punto