Obtaining Explicit Consent Is Not Enough: The Turkish Data Protection Board Formalizes Its Established Approach Through a Principle Decision!
- Jun 3
- 3 min read
Selin Çetin Kumkumoğlu
Danışman
Yaren Alparslan
The Personal Data Protection Board (“Board”) has issued a principle decision (“Principle Decision”), published in the Official Gazette dated 2 June 2026 and numbered 33268, providing an assessment under the Data Protection Law No. 6698 (“DPL”) regarding the use of biometric data for employee attendance tracking. The Principle Decision offers a comprehensive analysis of the lawfulness of widely used biometric systems (such as fingerprint and facial recognition) both in terms of the conditions for processing special categories of personal data and the general principles set forth under the DPL.
The Validity of Explicit Consent
The Principle Decision notes that, in practice, employers frequently rely on systems requiring the processing of biometric data to monitor employee attendance, and evaluates the validity of obtaining explicit consent from employees pursuant to Article 6 of the DPL in this context. In doing so, the Board analyzes whether the legal requirements for valid explicit consent are satisfied.
The Board concludes that, due to the inherent imbalance of power in the employer–employee relationship, employees may not be afforded a genuine opportunity to refuse or withdraw consent. Consequently, explicit consent provided by employees in such circumstances will, in most cases, not be deemed to be freely given. Furthermore, the revocability of consent directly affects the continuity of biometric systems, leading the Board to determine that reliance solely on explicit consent does not constitute a legally sustainable basis for such processing activities.
Lack of Legal Basis for Biometric Attendance Tracking
While acknowledging that employers are obliged under the Labour Law No. 4857 to monitor and document employees’ working hours, the Board emphasizes that there is no explicit legal provision mandating or permitting the fulfilment of this obligation through the processing of biometric data. Accordingly, the Board states that none of the other legal grounds set out under Article 6 of the DPL other than explicit consent are applicable in the context of attendance tracking, thereby highlighting a significant lack of legal basis for such processing activities.
The Principle of Proportionality and Alternative Methods
The Principle Decision underscores the decisive role of the principle of proportionality in assessing the lawfulness of personal data processing activities. In this respect, the Board stresses that any processing activity must be necessary, suitable, and proportionate to the intended purpose.
In the context of attendance tracking, the Board considers that less intrusive alternatives, such as password-protected card systems, PIN-based access, attendance sheets, RFID/NFC cards, or manual recording methods are available. Accordingly, it concludes that the use of biometric data is not necessary and therefore fails to meet the proportionality requirement. The Board further clarifies that, even where explicit consent has been obtained, the processing of biometric data for attendance tracking purposes would still be considered unlawful.
Alignment with the Decisions of the Constitutional Court and Council of State
The Principle Decision also refers to the decisions of the Constitutional Court and the Council of State regarding biometric attendance tracking practices. The Constitutional Court has characterized fingerprint-based attendance tracking as an interference with the right to privacy and the protection of personal data, emphasizing that such interference can only be deemed lawful where it is based on a clear, specific, and foreseeable legal provision.
Similarly, the Council of State, particularly in cases involving public institutions, has assessed biometric attendance systems in light of the general principles of the DPL, notably the requirement that data processing be relevant, limited, and proportionate to the purpose pursued. It has underlined that data which is not necessary for the intended purpose should not be processed.
These approaches are closely aligned with the Board’s findings in the Principle Decision, particularly regarding the absence of a clear legal basis, the insufficiency of explicit consent on its own, and the conclusion that the use of biometric data in the presence of less intrusive alternatives violates the principle of proportionality.
Conclusion and Practical Implications
The Board concludes that, under the current legal framework, the processing of biometric data for attendance tracking purposes does not rely on a valid legal ground and does not comply with the general principles set forth under Article 4 of the DPL, particularly the principle of proportionality.
Accordingly, data controllers are explicitly required to adopt less intrusive alternative methods instead of biometric systems. The Board further indicates that failure to comply with these requirements may result in administrative sanctions under Article 18 of the DPL. In this context, employers currently using biometric data to monitor employee attendance are expected to promptly review and update their existing practices.
¹ Decision of the Plenary of the Constitutional Court dated 10 March 2022, concerning application no. 2018/11988 regarding attendance tracking through a fingerprint registration system.
² Decision of the Plenary of the Council of State Administrative Law Chambers, numbered 2024/225 (Merits) and 2024/2625 (Decision).
