Is Taking the Fingerprint of a Laborer at the Workplace a Practice Carried Out in Compliance with the Law on the Protection of Personal Data?

After the concept “personal data” made an overwhelming impression in the international platform, this concept came into our lives officially with the Law on the Protection of Personal Data (“the PDPL” or “the Law”) in 2016. The objective of the Law is to prevent any unlawfully sharing and use of personal data in the absence of the data subject’s consent, which personal data is namely an extension of the right to personality in our national legislation as this is the case with the international legislation. The PDPL defines personal data as “any data related to an identified or an identifiable real person”. Considering this definition, it is possible to say that almost all data related to a real person can be regarded as personal data and are under protection within the scope of the PDPL. 

In the PDPL, another definition relates to the special categories of personal data. According to the definition: “Data related to race, ethnicity, political opinions, philosophical opinions, religion, sect or other beliefs, appearance; association, foundation or trade union memberships; health, sexual life, criminal convictions and security measures, and biometric and genetic data are special categories of personal data”. In the light of this definition, it is observed that the Law lists special categories of personal data on a numerus clausus basis and does not allow to broaden the scope. Since fingerprint is included in the class of biometric data, it is covered by the special categories of personal data.  

For the processability of special categories of personal data, in other words, sensitive data, the Law makes a dual distinction, and determines the conditions differently for the data related to health and sexual life and the other sensitive data. The Law lays down special conditions for the processing of the data related to health and sexual life. However, for the processing of the sensitive data other than the data related to health and sexual life, the Law admits only the explicit consent and the cases specified expressly in the Law. In our newsletter, we will analyze within the framework of the laborer-employer relationship the processing of fingerprint which is a biometric data.

First of all, we find it beneficial to define who the laborer is. According to the Labor Code, every real person working on the basis of an employment contract is in the laborer status. The laborer’s working conditions, e.g. the laborer’s daily and weekly working hours, the intervals of the working hours and other matters, are determined in the employment contract. By the nature of the employment contract, since the laborer is bound by the employer’s orders and instructions, the laborer works under the employer’s observation and supervision. Within this scope, the employer inspects the hours when the laborer starts and ends performing his work at the workplace and the employer keeps the relevant proofs in order to fulfill the burden of proof in a possible dispute and may even terminate the employment contract for this reason, if the conditions have taken place. Today, with the advancement occurred in the technology, the inspection mechanisms in the employment relationships have also changed and automatic recording systems or online algorithms have started to be used. Taking the laborer’s fingerprint by the employer while the laborer starts and ends performing his work at the workplace constitutes one of these inspection mechanisms. As a matter of fact, the employer obtains a precise information by means of the fingerprint record which is a unique data; and in case of a dispute, the employer is able to prove the circumstance conclusively by means of the fingerprint records, rather than the evidence whose trueness is uncertain, such as witness statements or records kept by other persons.

Given the sensitive data nature of fingerprint records, it will be possible to record fingerprints upon the relevant explicit consent or in the cases allowed expressly by the Law. Within the framework of an employment relationship, since there is no circumstance prescribed by the Law, it will be possible for the employer to process and keep the laborer’s fingerprint only if the laborer’s explicit consent is obtained. In this regard, a practice carried out without obtaining the laborer’s explicit consent would be unlawful, and such practice would become lawful only in case the laborer grants explicit consent for the taking and processing of his fingerprint. In obtaining the explicit consent, the time-related requirement is that the laborer grants his explicit consent before his fingerprint is taken. Apart from that, this consent may also be obtained before or after the employment relationship is established. The employer is under the obligation to inform, while obtaining the explicit consent. Within the context of this obligation, the employer should precisely state the reason why the laborer’s fingerprint is taken, the reason of the processing, and the person or entity to whom and under what conditions this data will be transferred, if to be transferred. However, a declaration of explicit consent will be valid if the obligation to inform has been fulfilled completely and accurately. At this point, the fact necessary to be taken into consideration is that, in case of a dispute, the courts adopt the principle of interpretation in favor of the laborer on the ground that the laborer is in a weaker position than the employer. In other words, the matter of whether or not the explicit consent is granted actually with the free will is examined by the courts in respect of the employment relationships more attentively than other contractual relationships. Therefore, the obligation to inform is of importance for the employers who carry out inspections by taking fingerprints.

In conclusion, it is possible to take a laborer’s fingerprint at a workplace only in case the laborer has granted the relevant explicit consent. However, the explicit consent shall be deemed to be valid only if the obligation to inform has been fulfilled completely and accurately. If the practice of taking finger print is carried out without obtaining the laborer’s explicit consent, this will be an operation conducted unlawfully, and the employer’s administrative liability will come into question under the PDPL as well as his criminal liability under the Turkish Criminal Code.