Managing Employee Monitoring in the Workplace

According to the Law, personal data must be processed in accordance with the law and principles of fairness, for specific, clear, and legitimate purposes, and must be limited and proportionate. Data processing must adhere to the procedures and principles set forth by the law. In general, personal data can only be processed with explicit consent, except in certain exceptional cases. "Explicit consent" refers to freely given, informed consent for a particular purpose.

Principles of Camera Usage: Permission, Purpose, and Privacy

According to the Article 4 of the Occupational Health and Safety Law, employers must take necessary precautions for workplace health and safety, and security cameras can be seen as a tool to fulfill this obligation. While monitoring employees and workplace activities via surveillance cameras falls within the scope of managerial rights, it is imperative that these rights be exercised in accordance with the overarching principles of the law, particularly the principle of proportionality. This ensures that any such monitoring is balanced, reasonable, and aligned with the specific objectives of workplace safety and security.

Camera recordings processed based on the data controller’s legitimate interests without the need for explicit consent are generally limited to purposes such as ensuring workplace security, preventing or clarifying incidents that may constitute a criminal offense, and maintaining the safety of physical premises; in such cases, providing an information notice is sufficient. However, if camera recordings are processed for purposes such as evaluating employee performance, using the footage in training processes, conducting customer satisfaction analyses, or for marketing and promotional activities (e.g., sharing on corporate social media accounts or using in promotional videos), such processing falls within the scope of explicit consent and requires obtaining the data subject’s explicit consent.

We would like to remind employers of some important considerations they must keep in mind when recording camera records:

• The data controller (i.e. employer) must establish policies and procedures for data storage, define retention periods, and take necessary technical and administrative measures. Additionally, if there is a retention period specified in the legislation, it must be adhered to; if not, data must only be stored for the period necessary for the purpose it was processed. Once the retention period for camera recordings expires, the data controller is obligated to destroy the recordings in accordance with the law.

• Camera recordings must be made with the knowledge and/or explicit consent of employees, and misleading or incomplete information must not be provided. The purpose, areas, and duration of camera use should be transparently communicated to employees in writing, and the data controller must fulfill their obligation to inform and warn, and in some cases, to obtain explicit consent.

• In cases where explicit consent is required, the consent must be obtained in accordance with the law, and the person giving consent must not be under any defect of will.

• Recording in areas where privacy is expected (e.g., toilets, restrooms) is unlawful.

• Camera usage should be limited to legitimate purposes and should not be used for vague purposes such as monitoring employee performance or general supervision, but rather for specific, clear, and legitimate interests. If the data controller processes data for purposes other than those specified, they will be held responsible.

• In cases where camera recordings are subject to judicial or administrative investigation by relevant authorities, sharing the recorded data with these authorities may be possible. However, under no circumstances can these recordings be shared with unauthorized third parties.

  
  
  
  

Relevant Decisions of the Court of Cassation, the Council of State and the Personal Data Protection Board

On the 1st of June 2020, the 22nd Civil Chamber of the Court of Cassation (the Court), in its decision numbered E.2020/1482 and K.2020/5244, ruled that recording audio in the workplace without the consent of employees constitutes a violation of the law and that such recordings cannot be admitted as evidence. It was emphasized that the employer lacked a legitimate basis for making audio recordings through security cameras, thereby violating the right to the protection of personal data. The Court further determined that the employee had not been informed of the audio recording and had not given consent. Accordingly, the judgment rendered by the labor court against the employee was overturned on the grounds that evidence obtained unlawfully cannot be used.

By its decision dated 11 February 2011, numbered E.2019/10118 and K.2021/43, the 10th Chamber of the Council of State addressed the use of security cameras in workplaces, underlining that the recordings should only be monitored by authorized personnel and that the privacy of private life must be respected. It was noted that warning signs must be placed in areas under surveillance and that unnecessary recordings must not be retained. Moreover, the decision emphasized the necessity of maintaining a balance between security concerns and the right to privacy.

In its decision dated 24 November 2022, numbered 2022/1249, the Personal Data Protection Board (the Board) concluded that personal data processed through security cameras are of a general nature and must be used solely for identification purposes and for the prevention of unauthorized access.

Another decision rendered by the Board on 10 August 2023, numbered 2023/1356, underlined that employees may not have a genuinely equal alternative in cases where consent is not freely given, thereby undermining the validity of consent. The Board further stated that data processing in areas where privacy is expected may infringe upon employees’ private spaces, rendering such processing unlawful. It was also noted that surveillance in private spaces, including places of worship, is contrary to the law.

Administrative Fines as a Sanction:

According to Article 12 of the Law, the data controller is obliged to take necessary security measures to prevent the unlawful processing of personal data. In case of non-compliance with this obligation, an administrative fine ranging from TRY 204,285,000 to TRY 13,620,402 may be imposed pursuant to Article 18 of the Law.

For further inquiries or legal assistance, feel free to contact Durukan+Partners team.

Sources:

Personal Data Protection Law

Decision of the Court of Cassation – 22nd Civil Chamber, Case No. E.2020/1482, Decision No. K.2020/5244, dated 01.06.2020

Decision of the 10th Chamber of the Council of State – Case No. E.2019/10118, Decision No. K.2021/43, dated 11.02.2011

Decision of the Personal Data Protection Board – KVKK, Decision No. 2022/1249, dated 24.11.2022

Decision of the Personal Data Protection Board – KVKK, Decision No. 2023/1356, dated 10.08.2023