The Overtime Tracking System with Fingerprints has been Evaluated by the Constitutional Court as a Violation of Rights!

As a result of the individual application, the Constitutional Court decided that fingerprint tracking at workplaces is an act that violates the right to request the protection of personal data within the scope of respect for private life. The decision of the Constitutional Court reveals the issues that need to be considered and evaluated in terms of the implementation of a personnel tracking system using the method of recording biometric data.

Concrete Case Summary

In the related case, the applicant is working as a public employee at Söke Mayor’s Office and the fingerprint of the applicant has been recorded because fingerprint tracking has been started at the workplace. The applicant objected to the recording of his fingerprint and the work monitoring with fingerprint tracking by petition and requested annul of such practice. Upon the refusal of the applicant’s request, the applicant filed an annulment lawsuit before the Administrative Court. The Administrative Court decided to accept the case and annul the administrative action by referring to the relevant legislation. The work monitoring of personnel by fingerprint tracking system should be evaluated within the framework of processing personal data as a part of the right to respect for private life. Upon the appeal of the administration, the Regional Administrative Court has accepted the appeal application and rendered a peremptory decision to dismiss the case by stating that the administration can monitor the public employees by fingerprint tracking together with the developing technology and there is no prohibition in the law. Upon the decision given, the applicant has submitted an individual application to the Constitutional Court.

Evaluation by the Constitutional Court

While evaluating the concrete case by the Constitutional Court, reviewal was based on the 20th article of the Constitution titled “Privacy of Private Life” and the “Right to Request the Protection of Personal Data” regulated by the third paragraph of the relevant article together with the principle of legality and the evaluation has been made within the scope of the 6th article of the Personal Data Protection Law No. 6698 on the processing of personal data of special nature, the decisions of the Personal Data Protection Authority and the decision of the European Court of Human Rights. By the relevant Constitutional articles and other laws and decisions are examined, the Constitutional Court has stated that when the legislation is examined for the submitted application, it has seen that there are regulations regarding the determination of the working hours of civil servants and the starting and ending times of daily working hours under the Civil Servants Law no.657, however it has come through that there is no clear regulation regarding processing of sensitive personal data for this purpose, the applicant does not have consent for the processing of sensitive personal data and the right to request the protection of personal data within the scope of respect for private life has been violated due to the processing of sensitive personal data by the administration without any legal basis.

The following points were also highlighted by the decision rendered by the Constitutional Court:

• To record and use the fingerprints of the employees which are considered sensitive personal data, it is necessary to have a separate and an explicit legal regulation or have the explicit consent of employees.
• In the case of processing sensitive personal data based on the employee’s consent, first of all, the principle of legality must be met, and to be able to discuss the existence of explicit consent, it is essential that the employee is adequately informed beforehand about the purpose, limits, and consequences of the personal data to be processed.
• However, it can be said that these methods can be applied limited to the purpose within the scope of the supervision and management authority of the employer administration, as a rule, if there is a legitimate purpose and there is no other way suitable to achieve this purpose with less interference with state and freedom of.
• If employees do not have their consent to the processing of personal data, sensitive personal data can be processed only in cases expressly regulated by law.

In terms of the concrete case, it has been concluded that the intervention subject to the application does not meet the legality requirement because in this direction, there is no regulation for the processing of sensitive personal data in the Law on the Protection of Personal Data No. 6698 and in the Law No. 657 on Civil Servants and the Municipality Law No. 5393, the applicant did not give consent for the processing of sensitive personal data and the said application is not foreseen separately and explicitly by the laws.

Result

Besides revealing the limits of the employer’s right to management and supervision against the employee; at the same time, The Constitutional Court decision regarding the concrete case is also important in terms of preventing the loss of rights against the employees through work monitoring that violates the right of employees to demand the protection of personal data attributing the importance of the positive obligation of the state to the individual.