- within Privacy topic(s)
- in United States
- within Privacy, Cannabis & Hemp and Technology topic(s)
The Principle Decision of the Personal Data Protection Authority (“Authority”) on the Processing of Biometric Data for Time and Attendance Tracking Purposes (“Decision”) was published in the Official Gazette dated 2 June 2026 and numbered 33268.
The Decision was issued in response to the increasing use of biometric identification systems for employee attendance tracking and the complaints submitted to the Authority in this regard. Within the scope of the Decision, the legal boundaries of processing biometric data for monitoring employee attendance and working hours have been assessed, and important determinations have been made to guide practice.
1. Legal Framework for the Processing of Biometric Data
Pursuant to Article 6 of the Law No. 6698 on the Protection of Personal Data (“Law”), biometric data constitutes a special category of personal data. The processing of such data is subject to the existence of one of the legal grounds prescribed for the processing of special categories of personal data under the Law and entails stricter obligations and protection measures for data controllers. In addition, while processing biometric data, data controllers must implement the adequate safeguards determined by the Personal Data Protection Board’s Decision No. 2018/10 dated 31 January 2018.
With respect to the Labour Law No. 4857, although the legal framework governing employers’ obligations to monitor and document employees’ working hours has been established, there is no explicit legal provision requiring or expressly permitting the fulfilment of this obligation through biometric identification systems. In this context, the Board concluded that there is currently no legal regulation that either mandates or explicitly authorizes employers to process biometric data for attendance tracking purposes.
Indeed, in practice, biometric data processing activities are predominantly carried out on the basis of the explicit consent of the data subjects pursuant to subparagraph (a) of the third paragraph of Article 6 of the Law.
2. Determination that Explicit Consent Does Not Constitute a Sufficient Legal Basis
The Board made several assessments regarding the nature and validity of explicit consent obtained from employees for the processing of biometric data for attendance tracking purposes.
In this regard, the Board emphasized that:
- There is an inherent imbalance of power between employer and employee;
- Employees may have legitimate concerns that refusing to provide consent or withdrawing previously granted consent could lead to adverse consequences;
- Therefore, explicit consent given within the context of an employment relationship cannot always be considered to be based on free will.
The Decision further states that, since the continuity of biometric systems would be disrupted if employees were to withdraw their consent, biometric data processing activities carried out solely on the basis of explicit consent would, as a rule, not provide a sufficient legal basis.
According to the Decision, not only the validity of explicit consent but also the compliance of biometric data processing for attendance tracking purposes with the general principles set forth under the Law must be assessed. In this regard, the Board referred to a decision of the Constitutional Court concerning the use of fingerprint systems for attendance tracking. In the aforementioned decision, the Constitutional Court concluded that, due to the absence of a clear legal framework governing the essential principles of biometric data processing, the interference failed to satisfy the requirement of legality.
In light of these assessments, the Board concluded that explicit consent alone cannot constitute a sufficient legal basis for the processing of biometric data for attendance tracking purposes due to the structural imbalance inherent in the employer-employee relationship.
3. Emphasis on the Principle of Proportionality
One of the fundamental grounds of the Board’s Decision is the general principles set forth under Article 4 of the Law, particularly the principle that personal data must be “relevant, limited and proportionate to the purposes for which they are processed.”
Within this framework, the Board evaluated:
- Whether the processing of biometric data for attendance tracking purposes is necessary;
- Whether the processing activity is relevant, limited and proportionate to its intended purpose;
- Whether the same objective can be achieved through less intrusive methods.
The Board specifically referred to alternative methods such as card-based access systems, PIN-based entry systems, attendance sheets and signature logs.
Accordingly, the Board stated that where less intrusive alternative methods capable of achieving the same purpose are available, the processing of biometric data would not satisfy the principle of proportionality.
4. Conclusion
As a result of its assessment, the Board concluded that:
- There is currently no legal provision that explicitly requires or authorizes the processing of biometric data for attendance tracking purposes;
- Due to the imbalance of power inherent in the employer-employee relationship, explicit consent alone does not constitute a sufficient legal basis;
- Since less intrusive alternative methods are available, the processing of biometric data does not satisfy the principle of proportionality;
- The existence of explicit consent alone may not be sufficient to render biometric data processing activities lawful.
Accordingly, the Decision has significant implications for employers that currently use biometric systems for attendance tracking or are considering implementing such systems. Employers are therefore advised to review their existing practices and, where possible, evaluate less intrusive alternatives for monitoring employee attendance.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
