Following fast development in information technologies and intensive processing activities of any personal data, the need for the protection of personal data has become incrementally vital. To meet such needs, the Personal Data Protection Law No. 6698 ("Law") entered into force in Turkey on 07-04.2016 and imposed certain obligations on data controllers and data processors. Employer-employee relations, an area where personal data is heavily processed, have also been affected by the Law and its secondary regulations. Employers were already obliged to keep their employees' personal data confidential by certain regulations such as the Turkish Code of Obligations, Labor Law, and Occupational Health and Safety Law, and their obligations have increased with the entry into force of the Law.
Article 5 of the Law regulates the legal bases for the processing of personal data and as a rule, personal data can only be processed with the explicit consent of the data subject. However, it is possible to process personal data without explicit consent among others if one of the following legal bases set forth under Article 5 of the Law exists such as: (i) being expressly permitted by any law, (ii) the data controller's legal obligation, (iii) being necessary for the performance of a contract. and (iv) being necessary for the legitimate interest of the data controller.
Among these legal bases, legitimate interest is a base that employers frequently rely on when processing the personal data of their employees. Employers interpret legitimate interest quite broadly and resort to it in cases where they cannot rely on any other legal bases since the concept of legitimate interest was not defined in the Law. This leads to unlawful processing of employees' personal data and irreparable consequences on their private lives. Legitimate interest should thus be evaluated according to the specific circumstances of each processing activity and be approached narrowly. Employers should apply this basis only in exceptional cases, and such processing activity should both be the only way and be necessary to achieve the legitimate interest of employers. Hence, should there be another data processing method, such should be the method preferred by the employer.
Although legitimate interest is not defined in the Law, the Personal Data Protection Board ("Board") has addressed this concept in its decisions and guidelines that set forth required elements for the data controller to rely on while determining whether the concept of legitimate interest can be used during their processing activities or not. These are: (i) the fundamental rights of the data subject should not be harmed and the data controller's interest and the data subject's right should be at a competing level. (ii) such processing should be necessary to achieve the interest. (iii) legitimate interest should be present. specific and clear, (iv) legitimate interest should not only aim for an economic benefit and the benefit to be provided should affect more than one person, and (v) a balance between the data controller's interest and the data subject's rights should be established. According to the Board, these elements should coexist in each data processing activity and the data controllers should still ensure compliance with general principles specified in Article 4 of the Law. Besides, the data controllers should inform data subjects (e.g., employees) and take necessary administrative and technical measures to maintain data security.
Practice Area News
Whether employers have legitimate interest while processing their employees' data has also been discussed in judicial decisions as well as the Board's decisions. Pursuant to the latest decision of the Board dated 19 of January/2023, the Board assessed whether employer's monitoring of corporate e-mail correspondences is within the scope of its legitimate interest. The Board stated that a balance test should be conducted between ensuring employee's confidentiality and the purpose of the employer, such as efficient use of resources. Remarking that the employer had previously informed its employees regarding possible audits through policies, the Board concluded that the employer has a legitimate interest provided that the employer complies with the elements of legitimate interest and general principles of processing. Besides, the Constitutional Court ("Court") mentioned in its decision dated 17 of September/2020 and numbered 2016/13010 that the employer may have a legitimate interest in controlling the communication tools in order to ensure effective conduct of the business, however employers subject to the legal boundaries while exercising this authority.
As seen, employers tend to process their employees' personal data under the umbrella of exercising their right to supervise employees. Even though this right generally arises from legislation and is based on the necessity to achieve the purposes of their workplace; employers should take into consideration whether their processing activities meet the elements of legitimate interest. It is substantial for employers to establish a balance between the interest in processing and the rights of their employees. To avoid any unlawful data processing activity, it is recommended to process only the data which is required for the employment relationship and necessary to enable the employer to fulfil its legal obligations arising from the legislation.
Our Rankings in The Legal 500 2023
Originally published by Legal Industry Review
© Kolcuoglu Demirkan Koçakli Attorneys at Law 2020
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
