Click the button to listen to our legal alert now!
Recent Development
The Constitutional Court’s Decision No. 2018/11988 regarding an applicant’s right to request the protection of their personal data was published in the Official Gazette dated 19 April 2022. The Constitutional Court evaluated the legal grounds for processing biometric data. The decision is available online here (in Turkish).
Background
The municipality where the applicant works switched to a fingerprint system for shift tracking. The applicant claimed that the recording of fingerprints for shift tracking violates their right to private life and filed a lawsuit before the administrative court for the annulment of the fingerprint system. The administrative court evaluated the issue within the framework of the processing of personal data within the scope of the right to respect for private life, and decided that the system in question is unlawful on the grounds that there was no legal basis for this type shift tracking. The Court of Appeal decided that the shift tracking system is not in violation of the law, considering that public personnel are obliged to work during their shift and the administrative bodies have the obligation to supervise their shifts. Accordingly, the applicant applied to the Constitutional Court.
Evaluation of the Constitutional Court
The Constitutional Court evaluated the application within the scope of the right to request the protection of personal data as per Article 20 of the Constitution of the Republic of Turkey. The Constitutional Court pointed out that the state has positive obligations to prevent the unlawful intervention of third parties with the fundamental rights and freedoms of its citizens. The Constitutional Court pointed out that the restrictions on rights and freedoms must: (i) have a lawful basis; (ii) rely on legitimate causes under the Constitution; and (iii) comply with the needs of a democratic society and the principle of proportionality, according to Article 13 of the Turkish Constitution. The Constitutional Court focused its evaluations on having a lawful basis.
The Constitutional Court referred to the Law No. 6698 on the Protection of Personal Data (“LPPD“) and stated that, in the case at hand, the fingerprint data (i.e., sensitive personal data) of an individual can be processed based on the explicit consent of the relevant individual or in cases expressly stipulated in the laws, without seeking explicit consent. The Constitutional Court emphasized that even in cases where the explicit consent of data subjects are present, the processing activity must have a legal basis based on the Article 13 of the Constitution.
In the case at hand, it is evident that the applicant did not give their explicit consent for the processing of their sensitive personal data. Therefore, the Constitutional Court evaluated whether there is a legislation stipulating the processing of fingerprint data for shift tracking purposes. In this context, the Constitutional Court made evaluations based on the LPPD, Public Personnel Law and Municipality Law. As per the Public Personnel Law, there are certain provisions regulating the determination of start and end of shifts; however, such provisions do not explicitly allow the processing of sensitive personal data for monitoring the personnel’s shifts. Similarly, the Constitutional Court pointed out that the management and organization of the municipality is under the duties of the mayor, as per Municipality Law; however, the law does not provide a clear provision on the processing of sensitive personal data within the scope of the duties of the mayor.
In light of these evaluations, the Constitutional Court decided that there is no regulation that allows the processing of biometric data for the purpose of shift tracking or determines its basic principles. Accordingly, the Constitutional Court determined that the interference of personal rights does not have a legal basis, considering that the applicant did not give their explicit consent and the legislation does not explicitly address the processing of sensitive personal data.
Conclusion
The Constitutional Court made important evaluations regarding the processing of biometric data in its decision. It evaluated that processing biometric data must be subject to the data subject’s explicit consent or the processing must be clearly stipulated under the laws. Accordingly, the Constitutional Court underlined that there must be clear regulations stipulating the processing of biometric data.
