What are the Regulations on the Processing and Protection of Personal Data in the Labor Law?

When the relationship between the protection of personal data and labor law is examined, on the one hand, the employer's need for data on the education of the personnel to be hired, the workplaces where they have worked in the past and the work they have done, their health problems, and their judicial proceedings within the scope of the effort to select the appropriate personnel in job applications in order to employ personnel with the appropriate qualifications for the job, and on the other hand, the surveillance of work areas with cameras in order to increase occupational safety and efficiency at work, The importance of the protection and processing of personal data in labor law increases due to the necessity of taking precautions at entrances and exits, the necessity of keeping records on computers for employees, the inability of the employee to say no to the personal data requested by the employer due to his/her dependency on the employer, the necessity of training the employees acting on behalf of the employer, who will be accepted as the data controller, on personal data and the establishment of a system to ensure security. It is also a fact that the Labor Law does not contain detailed regulations on the subject.

Personal Data of Workers and Processing of Such Data

Personal data includes the identity, address and occupational information of workers, whether they are married or not, date and place of birth, citizenship status, criminal record, information about their health and diseases, political or union activities, e-mail correspondence, religion, race, ethnic origin and sexual preferences. Employers process, use, and in some cases share personal data of their employees with third parties for purposes such as fulfilling the obligations regulated in the Labor Law, employee training, occupational health and safety, controlling customer relations, and promotions.

Article 8 of the Labor Law regulates the content and form of the employment contract. Within the scope of the article, the employment contract is not subject to a special form, unless otherwise specified in the law. Employment contracts with a duration of one year or more must be made in writing. In cases where the contract is to be made in writing, it is understood that the essential elements of the contract such as the parties, scope, remuneration, etc. should be recorded and personal data should be shared in this case. In paragraph 5/2 (c) of the KVK Law, it is regulated that personal data can be processed without seeking consent in the event that "it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract". 

Article 75 of the Labor Law titled "Worker's personnel file" stipulates that the employer shall organize a personnel file for each worker employed by the employer, that the employer is obliged to keep in this file, in addition to the identity information of the worker, all kinds of documents and records that it is obliged to issue in accordance with the Labor Law and other laws and to show them to authorized officers and authorities upon request, that the employer is obliged to use the information obtained about the worker in accordance with the rules of honesty and law and not to disclose the information that the worker has a legitimate interest in keeping confidential. Article 75 of the Labor Law obliges the employer to keep the identity information of the employee in a file. 

Article 25 of the Labor Law titled "Employer's right to terminate immediately for just cause" stipulates that the employer may terminate the contract immediately for just cause in the event that the Health Board determines that the employee's illness is incurable and that it is inconvenient for the employee to work at the workplace, or in the event of the employee's absenteeism due to a disease or disability arising from his/her own intention or disorderly living or indulgence in alcohol, the employer has the right to access the health data of the employee for this purpose. 

Considering that the same article also states that the employer has the right to terminate the employment contract for just cause in the event that the employee misleads the employer by claiming that he/she has the qualifications or conditions required for one of the essential points of this contract when he/she does not have them at the time the employment contract is concluded, it is understood that the employer may request information on the essential issues of the contract in the interviews to be held with the employee before hiring and may request personal data such as education, diploma, previous workplaces, licenses, etc.

Processing of Personal Data of Employees under the Provisions of the Turkish Code of Obligations

Article 419 of the TCO No. 6098 reads as follows: "The employer may use the personal data of the employee only to the extent that it is related to the employee's aptitude for the job or is necessary for the performance of the service contract. The provisions of special laws are reserved." The current regulation in the law is in line with the principle regulated in Article 4/2(ç) of the PDP Law that personal data shall be processed in connection with the purpose for which they are processed, limited and proportionate. Pursuant to Article 419 of the TCO, the employer may process the personal data of its employees to the extent necessary for the "performance of the service contract" and to the extent that it is related to the employee's aptitude for the relevant job. In this context, in relation to the processing of personal data of the employees by the employer, the personal data of the parties to the contract that are directly related to the establishment and performance of a contract in Article 5/2-(c) of Law No. 6698 may be processed without the need for explicit consent.  In addition, it is also possible to consider the processing of personal data of employees as a legitimate interest for the employer in an investigation to be conducted by the employer in the presence of a suspicion of misconduct.  Because in Article 63 of the TCO No. 6098, it is regulated that an act may not be considered unlawful and unfair act in the presence of a superior interest, and in accordance with the regulation in Article 5/2-(f) of Law No. 6698, if data processing is mandatory for the legitimate interests of the data controller, it is possible to process personal data without the need for explicit consent. However, in this case, the fundamental rights and freedoms of individuals must not be harmed. According to Article 417 of the Turkish Code of Obligations No. 6098, the employer is obliged to protect and respect the personality of the employee in the service relationship and to maintain an order in the workplace in accordance with the principles of honesty. 

Precedent Decision of the Constitutional Court

In the individual application numbered 2013/4825, the Constitutional Court, in its decision regarding the claims of the applicants working for a private company that their rights to respect for private life and confidentiality of communication were violated due to the employer's examination of their corporate e-mail accounts containing private correspondence and the use of these correspondence as evidence in the reinstatement case, stated that "From the case files subject to trial, the correspondence between the applicants was brought to the knowledge of the authorized persons or organs of the respondent company by a third party outside the case, after which the employer conducted an investigation on the corporate e-mail accounts, and the contracts were terminated on the basis that the elements in the obtained correspondence were in violation of the employment contracts, adding different grounds, ... .... ...Pursuant to the provisions of the employment contracts signed by the applicants and the employer, it is seen that the applicants accepted the Internal Regulations, the Basic Regulation, the orientation booklet, the Travel Regulation, instructions and procedures in force regarding the rules to be followed at the workplace as an integral annex and part of the relevant contracts and obliged themselves to comply with all these regulations. ........ In particular, with the Information Security Undertaking, the applicants undertook to their employers that they would not use the computers, e-mails, internet usage, telephones, communication programs, other IT resources and communication tools allocated to them by the Company for work purposes for personal purposes, for entertainment purposes, in violation of general morality, customs and traditions, to an extent exceeding their essential needs; they also made a declaration of acceptance and undertaking that the IT and communication resources used by the Company executives can be kept under surveillance at all times, the correspondence and communication records can be backed up, reported, examined in detail when necessary, confiscated and usage restrictions can be imposed without notifying and warning the applicants. ......... Furthermore, the employer examined the corporate e-mail accounts of the applicants, and did so in the belief that it could confirm the veracity of the allegation that the applicants had violated the Company's regulations after being informed about the e-mail correspondence submitted to the Company management by the second applicant's ex-wife. Considering the provisions of Law No. 4857 and the regulations in the employment contracts, it is concluded that the employer, who examined the correspondence of the applicants in order to verify whether the corporate e-mail accounts were used for personal purposes and in accordance with the Basic Regulation, had a legitimate aim and that the intervention carried out by the employer was proportionate to the said legitimate aim, and that these issues were taken into account in the justifications of the decisions rendered by the Trial Courts....... "Since it is understood that the positive obligations have been fulfilled in terms of the protection of constitutional guarantees by establishing relevant and sufficient justifications by the Courts of First Instance and that the contents of the correspondence were not made public in the proceedings carried out during the proceedings, it should be decided that the applicants' right to respect for private life guaranteed under Article 20 of the Constitution and the right to privacy of communication guaranteed under Article 22 of the Constitution have not been violated.

Evaluation of Camera Recordings and Biometric Data Taken at the Workplace within the Scope of Personal Data Protection Law

In its decision dated 07.05.2019 and numbered 2017/21857 E., 2019/9884 K., the 22nd Civil Chamber of the Court of Cassation dated 07.05.2019 and numbered 2017/21857 E., 2019/9884 K. regarding the issue of personal data, which is brought to the judiciary in the termination of the contract on the grounds of the aforementioned images in case of continuous recording of the images of the workplace and workers through the cameras to be placed in the workplace, it is always possible for the employer to monitor and follow the employee electronically as a result of the management right. However, for this, the employee must be informed about this monitoring. Failure to inform the employee that he/she is being monitored or surreptitious monitoring should be considered unlawful, even if the data obtained as a result of this monitoring clearly reveals that the employment contract has been violated by the employee. As such, in the concrete case, it should be accepted that it is not possible to claim the information obtained as a result of surveillance by the employer as a just cause of termination. While the court should conclude that the termination was not based on a just cause and that the plaintiff is entitled to notice pay, it is erroneous to decide to dismiss the case on written grounds, and the decision should be reversed for this reason." 

Monitoring workers with biometric methods and closed circuit television systems and keeping records of their personal data can also create serious problems. For example, a person's fingerprint has a unique quality that distinguishes them from all other individuals. Keeping such information, which is closely linked to an individual's personality, on record and transferring it to third parties can cause serious problems. For this reason, it is of great importance to determine the principles to be applied if these and similar methods are used to record issues such as entry and exit times. Even in cases where the practice is carried out in accordance with the law, deficiencies regarding data security may cause damage to the right to protection of the personal data of the worker.