The Constitutional Court found the collection of fingerprint data of the applicant for overtime tracking, which is biometric data, unconstitutional in its decision dated March 2022. The main reason is the violation of private life in terms of the right to demand the protection of personal data Article 20 of the Constitution, in its decision dated March 2022.
In the affair subject to the application, the Municipality where the applicant works as a government employee has set up a fingerprint system to track the working hours of its employees and has made it mandatory for all employees to have their fingerprints read. The applicant initially appealed to the mayor, and upon the rejection of his request, he filed a lawsuit in the Administrative Court for the annulment of the administrative act.
The administrative Court accepted the application; however, the Municipality brought the appeal to the higher court. The higher court was accepted to appeal, and Higher Court finalized the decision against the applicant.
Therefore, the applicant made an individual application to the Constitutional Court with the allegation that The Municipality violated the right to demand personal data protection within the scope of the right to respect for private life.
The Constitutional Court defined any information about a specific or identifiable natural or legal person as personal data and decided that an examination could be made in terms of the right to request personal data protection, which is guaranteed in the third paragraph of Article 20 of the Constitution.
According to Art. 20, personal data can be processed "only in cases stipulated by law or explicit consent". The Constitutional Court later stated that biometric data is among the special categories of personal data in Article 6 of the Law on the Protection of Personal Data. Biometric data includes biological or behavioural information belonging to that person, enabling a person to be separated from other persons and identify the person himself.
The Constitutional Court has determined that the fingerprint is biometric data because it contains physiological information that belongs to the person and helps identify the person's identity directly. Data controllers can process biometric data if the person expressly consents or without seeking consent if the processing is allowed by the Law.
The permit for processing data without seeking consent does not include the overtime period of the institutions or organizations. Thus, for fingerprints to be recorded and used, The employees must give explicit consent or be regulated explicitly by Law. There is no dispute that the applicant did not consent. It is understood that the processing and use of biometric data in the control of the employee's compliance with overtime is not separately and explicitly stipulated by the Law.
In addition, the Constitutional Court reminds us that the Law must comply with the criteria of necessity and proportionality, and a reasonable balance should be established between the data processing activity and the intended purpose.
As a result, if there is no such regulation in the Law, personal data cannot be processed without explicit consent.
In addition, if Law regulates the processing of biometric data or in general meaning special categories of data, the Law shall pursue the following principles;
- necessity and proportionality.
- a reasonable balance should be established between the data processing activity and the intended purpose;
- data minimization
- avoid processing data that is unnecessary for the other purpose, should choose the way that causes minor interference when processing personal data.
The Constitutional Court describes the main principles of processing biometric data. And the Court also show the road map to legislation in case of lawmaking of processing the sensitive data. The Legislation shall pursue the framework of the Constitution Court if they enact a Regulation on the subject of sensitive data processing.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
