Tracking employee hours with biometric data unlawful, says data protection authority

The Personal Data Protection Authority (KVKK) has ruled that tracking employee working hours through biometric data processing is unlawful.

In its decision published in the Official Gazette yesterday, the authority emphasized that while legal regulations draw the framework for employers to monitor and document working hours, there is no explicit statutory regulation allowing this to be done via biometric identification.

"Since there is no clear legal regulation providing for tracking to be done with biometric identification systems, carrying out attendance tracking through the processing of biometric data may constitute a violation of the law," the KVKK stated.

The authority said attendance tracking should instead be ensured through other methods including encrypted cards or PIN-based systems, traditional signature and paper-based attendance sheets, RFID/NFC identification cards, or manual entry under supervisor oversight.

While biometric identification systems such as fingerprints, facial recognition, iris scans, or retina scans appear attractive to employers due to being fast, accurate, and resistant to manipulation, this "forms an extremely sensitive area within the context of personal data protection law," according to the decision.

Employee complaints

The KVKK said that complaints regarding biometric systems are among the most frequent issues it receives from employees.

Highlighting a structural power imbalance in the employee-employer relationship, the authority expressed doubts over whether obtaining explicit consent from workers relies on free will.

Moreover, tracking practices must comply with the principles of proportionality, necessity, and data minimization, it added.

The KVKK is the highest decision-making body established to oversee the lawful processing of personal data and protect citizens' privacy rights in Turkey. Its legal framework is drawn by the Personal Data Protection Law No. 6698, which entered into force in 2016.

The KVKK is defined as a completely independent and autonomous structure that possesses administrative and financial independence and does not receive orders or instructions from any authority, organ, or person. It is affiliated with the Justice Ministry for bureaucratic procedures.

The board consists of nine members, with five elected by parliament and four appointed by the president. (AEK/VK)