The Personal Data Protection Authority (KVKK) has issued a public announcement regarding its principle decision on the processing of biometric data for the purpose of employee attendance tracking. The announcement stated that data controllers from various sectors have submitted requests for opinions regarding the decision, which was published in the Official Gazette on June 2.
The KVKK reminded that biometric data is classified as special category personal data under the Personal Data Protection Law No. 6698. The Authority also noted that the Population Services Law No. 5490 defines data unique to an individual obtained from fingerprints, vein patterns, and palm prints as biometric data collected for the purpose of identification and verification.
The announcement also responded to assessments suggesting that data obtained through methods such as palm scanning or fingerprinting should not be considered biometric data. The KVKK emphasized that data made suitable for uniquely identifying or verifying an individual through specific technical methods carries the nature of biometric data.
The Authority stated that converting such data into a mathematical code and storing it in a database does not eliminate its nature as biometric data. Thus, it was stated that systems such as fingerprint or palm scanners used for attendance tracking must be evaluated within the scope of the principle decision.
The KVKK pointed out that certain facilities and operational areas may be distinguished from general assessments in terms of security risks and the consequences of potential data breaches. However, it was noted that biometric data processing activities in these areas must also be limited to necessary critical areas and individuals, and must be proportionate and fit for purpose.
The announcement emphasized that the principle decision relates only to biometric data processing activities carried out for the purpose of employee attendance tracking. For biometric data processing processes outside of attendance tracking, it was reported that the assessment of compliance with the law will be conducted by data controllers, taking into account the purpose of data processing, the nature of the work, and the specific circumstances of the case.
The KVKK announced that the Personal Data Protection Board will evaluate each specific case separately in the event of any reports or complaints reaching the Authority.
News Source: 12punto
