Legal Status And Conditions For Processing Of Security Camera Recordings Under The Personal Data Protection Law

With the advancement of technology, security camera systems have become an integral part of daily life. Today, not only shopping malls, banks, or public institutions, but also apartments, residential complexes, offices, factories, hotels, and small businesses utilize camera systems for security purposes.

However, in practice, there is a widespread belief that camera systems used for security purposes do not pose any legal issue under the legislation regarding the protection of personal data. However, it should be noted that processing data for security purposes does not, by itself, render the data processing activity lawful; such activities must also be conducted in accordance with the principles and conditions set forth in the Personal Data Protection Law No. 6698 (“Law”).

In recent years, the Personal Data Protection Board (“Board”) has issued numerous decisions regarding the use of security cameras; furthermore, the Constitutional Court has also made significant rulings within the scope of the right to privacy and the protection of personal data.

• Personal Data Status of Images Captured by Security Cameras

Article 3 of the Law defines personal data as “any information relating to an identified or identifiable natural person”. The recording of a person’s image via camera also constitutes a personal data processing activity within this scope. Consequently, the collection, storage, monitoring, sharing with third parties, or deletion of camera recordings is subject to the provisions of the Law.

If data, such as a person’s facial image, physical characteristics, walking style, location, entry and exit times, or movements within a specific location make the person identifiable, these images constitute personal data. Consequently, camera recordings, in which a person’s identity is identified or identifiable, are considered personal data. If the system also records audio, the scope of the processed data expands, and the interference with fundamental rights becomes more significant.

In this regard, in its decision dated March 12, 2020 and numbered 2020/212, the Board noted that the use of security cameras with audio recording capabilities constitutes a much more severe intrusion into private life than video recording alone; it assessed that, unless the necessity of audio recording is concretely demonstrated, this practice may violate the principle of proportionality.

One of the most common misconceptions in practice is the belief that any use of cameras is lawful as long as there is a “security purpose”. However, under the Law, the key requirement is not merely the existence of a legitimate purpose; it is also the presence of a legal basis for data processing and compliance with the principles of legality and good faith, relevance to the purpose, proportionality, and limitation, as set forth in Article 4 of the Law.

• Constitutional Guarantee of the Protection of Personal Data

The right to the protection of personal data is also directly guaranteed under Article 20 of the Constitution. In this regard, the third paragraph of Article 20 of the Constitution states fundamental provisions such as “everyone has the right to request the protection of personal data concerning them. This right includes the right to be informed about personal data concerning oneself, to access such data, to request its correction or deletion, and to learn whether it is being used in accordance with its intended purposes. Personal data may be processed only in cases provided for by law or with the explicit consent of the individual. The principles and procedures regarding the protection of personal data are regulated by law”. This regulation has elevated the protection of personal data from merely being an extension of the right to privacy to an independent fundamental right.

The Constitutional Court has also emphasized in numerous decisions that the protection of personal data is an integral part of the protection of human dignity and privacy. For example, in its decision with Case No. 2013/122, Decision No. 2014/74 and dated April 9, 2014, the Constitutional Court stated that “the right to the protection of personal data, as a specific form of the protection of human dignity and the right to freely develop one’s personality, aims to protect the individual’s rights and freedoms during the processing of personal data. As a result of developments in information technology, it has become possible to collect vast amounts of data that could not be obtained through traditional methods; to centrally aggregate data that was previously stored in unrelated silos; and to increase the capacity to generate new data from existing data through analysis using advanced technological capabilities such as data matching and data mining; easier access to and transfer of data; and the fact that personal data has become a valuable asset for commercial enterprises—all of these factors have led to risks created by private-sector entities reaching more widespread and significant proportions, and to an increase in the activities of terrorist and criminal organizations aimed at obtaining personal data—making the highest level of protection for personal data imperative today”. By including these statements, the Constitutional Court has emphasized that the processing of personal data is directly linked to an individual’s right to the development of their material and moral well-being and that the state has an obligation to establish effective safeguards in this area.

• Assessment of Video Surveillance Under Supreme Court Decisions

The Supreme Court also acknowledges that interference with individuals’ private lives in security camera applications must be proportionate. In this context, the Supreme Court states that camera surveillance activities conducted by employers in the workplace must be limited to legitimate purposes such as the security of the business and the workplace; however, keeping employees under constant and intensive surveillance must be evaluated in terms of the privacy of private life and personal rights.

In its decision with Case No. 2015/4413, Decision No. 2016/4086 and dated March 15, 2016, the 12th Criminal Chamber of the Supreme Court noted that when assessing whether a security camera violates the right to privacy, the camera’s location, the angle of the footage, and whether there is an intrusion into individuals’ private spheres are critical factors. In this context, it is recognized that a distinction must be made between the monitoring of common areas for security purposes and the continuous surveillance of individuals’ private living spaces.

• Conditions for Processing Personal Data Obtained Through Camera Recordings

The processing of camera recordings does not always require explicit consent. Particularly in the case of workplaces, residential complexes, or commercial establishments, data controllers typically rely on the legal basis of “the data controller’s legitimate interest,” as set forth in Article 5/2-f of the Law. However, the existence of a legitimate interest alone is not sufficient; a reasonable balance must be struck between the data controller’s interest and the fundamental rights and freedoms of the individuals concerned.

In this regard, it is important that the recording of camera footage serves a genuine security purpose, that the area being recorded is limited in a manner appropriate to the purpose, that no more area than necessary is monitored, that the recordings are retained for a reasonable period of time, that the necessary technical and administrative measures regarding data processing are taken, and that the data controller fulfills its obligation to provide information.

In particular, public announcements recently issued by the Personal Data Protection Authority have noted that there have been numerous complaints regarding camera systems used in apartment buildings and workplaces; it has been emphasized that cameras should be limited to common areas, recording periods should not be unnecessarily extended, and recordings should be accessible only to authorized persons.

In its decision dated August 4, 2022 and numbered 2022/797, the Board acknowledged that camera systems may be used for the purposes of workplace safety, production safety, building security, and the protection of employees and visitors; it stated that keeping employees under constant surveillance, monitoring their performance, or using cameras at an intensity that would create psychological pressure is incompatible with the fundamental principles of the Law.

In practice, it may be seen that many data controllers believe they have fulfilled their obligation to provide information simply by placing a warning sign at entry points that reads, “this area is monitored by security cameras”. However, as clearly stated in the Public Announcement on the Use of Security Cameras in Workplaces issued by the Board, a general warning of this nature is not considered sufficient on its own to fulfill the obligation to provide information. The data controller must provide information to the data subjects regarding (i) the identity of the data controller, (ii) the purpose of data processing, (iii) the legal basis, (iv) to whom the data may be transferred, (v) the retention period, and (vi) the rights of the data subject, in accordance with Article 10 of the Law. This information must be made available, as far as possible, before entering the camera recording area or, at the latest, during the recording.

In addition, pursuant to Article 12 of the Law, data controllers are required to take appropriate technical and administrative measures to prevent the unlawful processing of personal data and unlawful access to personal data, and to ensure the protection of personal data. In this context, measures must be implemented to ensure that only authorized persons can access camera recordings, that access rights are restricted, that recordings are stored in secure environments, that access logs are maintained when necessary, and that the sharing of recordings with unauthorized third parties is prevented. Otherwise, the data controller may face administrative sanctions not only for unlawful data processing but also for violating the data security obligations set forth in Article 12 of the Law.

• Retention Period for Camera Recordings

It is not possible to store camera recordings indefinitely and according to the Board’s established practice, the indefinite storage of security camera recordings violates the principle set forth in Article 4 of the Law, which states that “data shall be retained only for as long as necessary for the purposes for which they were processed”. The data controller must determine the retention period in advance, incorporate it into the Personal Data Retention and Destruction Policy, and delete the recordings at the end of the period using automated or secure methods.

Although there is no statutory time limit in practice or in the regulations, the Board has not established a general maximum retention period applicable to all data controllers. In this context, the retention period must be determined and justified based on the purpose of data processing, security needs, and sector-specific obligations.

• Conclusion

While security cameras are one of the indispensable tools of today’s security policies, they also rank among the most common examples of personal data processing activities. For this reason, data controllers must consider not only security needs but also the fundamental rights and freedoms of individuals.

Common legal violations encountered in practice include vague retention periods, inadequate privacy notices, camera recordings that exceed the intended purpose, and the unnecessary use of audio recordings. When the Constitutional Court’s approach to the protection of private life, the Supreme Court’s proportionality-focused case law, and the Board’s decisions are evaluated together, it becomes clear that it is not the use of security cameras itself that poses a risk, but rather their use without regard for legal boundaries. Therefore, acting in accordance with the principles of the Law during the installation and operation of camera systems will strengthen the legality of data processing activities and will be crucial in preventing potential administrative sanctions and legal disputes in the future.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.