PUBLIC ANNOUNCEMENT REGARDING SECURITY CAMERAS USED IN WORKPLACES

The Turkish Personal Data Protection Authority published a public announcement regarding security camera systems in workplaces following reports and complaints submitted to the Authority alleging that such systems were being used unlawfully or for purposes other than those for which they were intended.

In this context, the announcement emphasized that, when assessing the necessity of security cameras, compliance with the principle of data minimization should be ensured; the purpose of installing cameras (such as ensuring workplace security, assisting in the prevention and detection of crimes, or protecting employees’ occupational health and safety) should be clearly determined; and cameras should not be used for other purposes, such as monitoring employees’ attendance or performance. It was further stated that purposes such as increasing productivity, maintaining discipline, or general supervision would not be regarded as legitimate purposes. Among the issues particularly highlighted in the announcement were that cameras should not be installed in private areas (such as prayer rooms or changing rooms), employees’ reasonable expectations of privacy should not be disregarded, the necessity of cameras capable of recording audio should be carefully assessed, the required privacy notices should be provided to the data subjects, unauthorized access to recordings should be prevented, retention periods should be complied with, automatic deletion mechanisms should be implemented, and the necessary internal company procedures regarding these matters should be established.

PUBLIC ANNOUNCEMENT REGARDING SECURITY CAMERAS USED IN APARTMENT BUILDINGS

The Turkish Personal Data Protection Authority published a public announcement regarding security cameras installed in apartment buildings following reports and complaints submitted to the Authority alleging the unlawful placement of cameras.

The announcement particularly emphasized that the privacy of apartment residents should be taken into consideration when positioning cameras. In this regard, cameras should not be installed in stairwells or in front of apartment doors in a manner that would allow the interior of a private unit to be visible when the door is opened. It was further stated that camera systems should not include technical features that interfere with private life, such as facial recognition or audio recording capabilities; that the reasons for installing cameras in elevators should be clearly specified; that recorded footage should be retained in accordance with the applicable retention period and subsequently deleted; that unauthorized access to recordings should be prevented; and that the obligation to provide a privacy notice regarding camera surveillance should be fulfilled.

PRINCIPLE DECISION REGARDING THE PROCESSING OF BIOMETRIC DATA FOR ATTENDANCE TRACKING PURPOSES

By its principle decision dated 29/04/2026 and numbered 2026/921, the Turkish Personal Data Protection Board stated that the processing of biometric data for attendance tracking purposes constitutes a violation of the Personal Data Protection Law.

In this regard, the Board determined that none of the processing conditions set out under Article 6 of the Law could serve as a valid legal basis for the processing of biometric data for attendance tracking purposes and that, even where valid explicit consent is obtained from the relevant individual, such processing would fail to satisfy the proportionality principle under the general principles set out in Article 4 of the Law. Accordingly, the Board stated that, instead of biometric systems, alternative methods should be used for attendance tracking, such as password-protected card or PIN-based systems, traditional signature and paper-based attendance sheets, RFID/NFC identity cards, or manual entry under supervisor oversight.

The Board also stated that data controllers processing data in violation of this decision would be deemed not to have implemented the necessary administrative and technical measures under Article 12 of the Law and would therefore be exposed to the risk of administrative fines pursuant to Article 18 of the Law.

ANNOUNCEMENT REGARDING A BINDING CORPORATE RULES APPLICATION

In its announcement dated 21/05/2025, the Turkish Personal Data Protection Authority announced that the Binding Corporate Rules (BCR) application submitted by Sosyo-Plus Bilgi Bilişim Teknolojileri Danışmanlık Hizmetleri A.Ş. had been approved by the Board.

Accordingly, for the first time following the amendments made to the Turkish Personal Data Protection Law in 2024, an international data transfer has been carried out through the approval of Binding Corporate Rules by the Board.

ANNOUNCEMENT REGARDING EXPLICIT CONSENT AND PRIVACY NOTICES

One of the most common unlawful practices encountered in practice is presenting the privacy notice provided to data subjects and, where required, the explicit consent obtained from them in an intertwined or combined manner.

In this regard, the Turkish Personal Data Protection Authority has stated in its announcement that, in every instance where personal data processing activities are carried out, data subjects must be duly informed. Where a processing activity is based on explicit consent, the privacy notice and the explicit consent text should be presented as separate documents under different headings. If the privacy notice and the explicit consent text are presented on the same page, they should be arranged under separate headings (one below the other), and separate declarations should be obtained for each text.

The Authority further emphasized that where the processing activity is based on any of the other legal grounds set out in the Law, explicit consent should not be obtained from the data subject. Only confirmation that the privacy notice has been read and understood should be requested; no declaration indicating approval of or consent to the privacy notice should be obtained.

It was also noted that such texts should be prepared specifically for each data controller and should not be copied and pasted from another data controller. In addition, lengthy, complex, and detailed texts should be avoided, and instead clear, simple, and understandable language should be used in order to ensure compliance with the Law.