I. INTRODUCTION
In today's technologically advanced world, surveillance cameras are frequently used in workplaces to ensure security, discipline and order in the workplace. However, the use of these technologies has the potential to affect the personal rights of employees and workplace visitors, especially their right to privacy. The protection of personal data is of great importance in order not to interfere with the private life of individuals, and for this reason, it is necessary to process the images collected by security cameras in accordance with the law.
Law No. 6698 on the Personal Data Protection Authority ("LPPD") stipulates strict rules for the processing of personal data and imposes many obligations on data controllers. This law covers both public institutions and the private sector and concerns all parties that process personal data. Images recorded by surveillance cameras are also considered personal data under the law, as these images can be used to identify or identify individuals.
In this context, the images obtained by the cameras used by employers for security purposes in their workplaces must be processed in accordance with the LPPD. It is the legal responsibility of employers to protect the personal data of both employees and other individuals visiting the workplace. In addition, employers must comply with the principle of data minimization in the processing of personal data, i.e. only the necessary data should be collected in a measured manner.
This article will discuss how the images obtained through security cameras used in workplaces should be evaluated within the framework of labor law legislation and the LPPD, and will examine the basic obligations that employers must comply with and the issues to be considered in the processing of personal data. In addition, the technical and administrative measures to be taken for the lawful use of security cameras will be discussed in line with the data processing principles stipulated in the LPPD.
II. EVALUATIONS WITHIN THE SCOPE OF LABOR LAW LEGISLATION
The employer has the obligation to ensure the safety of both the employee and the workplace in accordance with the labor law legislation, and in case of violation or negligence of this situation, legal and criminal liability may arise. In this respect, the direct regulation in the labor law legislation, especially regarding the video surveillance with security cameras, is included in Article 4 of the Occupational Health and Safety Law No. 6331 ("OHS Law"). Pursuant to the aforementioned article;
General responsibility of the employer
ARTICLE 4 – (1) The employer shall have a duty to ensure the safety and health of workers in every aspect related to the work. In this respect, the employer shall;
(...)
b) monitor and check whether occupational health and safety measures that have been taken in the workplace are followed and ensure that nonconforming situations are eliminated.
c) carry out a risk assessment or get one carried out;
d) take into consideration the worker's capabilities as regards health and safety where he entrusts tasks to a worker
e) take appropriate measures to ensure that workers other than those who have received adequate information and instructions are denied access to areas where there is life-threatening and special hazard.
In addition Article 14 of the OHS Law titled "Recording and Notification of Occupational Accidents and Diseases" stipulates (1) The employer shall; a) keep a list of all occupational accidents and diseases suffered by his workers and draw up reports after required studies are carried out. b) investigate and draw up reports on incidents that might potentially harm the workers, work place or work equipment or have damaged the work place or equipment despite not resulting in injury or death.
On the other hand, Article 3 of the OHS Law titled "Definitions" defines the hazard class as the hazard group determined for the workplace in terms of occupational health and safety, taking into account the nature of the work carried out, the substances used or emerging at every stage of the work, work equipment, production methods and forms, working environment and conditions and other issues related to occupational health and safety, and camera recordings will be important for employers included in the hazard class to prevent work accidents etc. and at the same time to prove their fault.
Conversely, with regard to intentional damages at the workplace, Article 25 of the Labor Law No. 4857 stipulates as grounds for immediate termination by the employer for just cause: "If the employee endangers the safety of the work due to his own will or negligence, damages or loses the machines, installations or other goods and materials which are the property of the workplace or which are not the property of the workplace but which are at his disposal to such an extent that he cannot pay with the amount of his thirty-day wage." In addition, Article 396 of the Turkish Code of Obligations No. 6098 titled "Duty of Care and Loyalty" stipulates that the employee is obliged to perform the work undertaken with care and to act loyally in protecting the rightful interest of the employer, and that the employee is obliged to use the machinery, tools and equipment, technical systems, facilities and vehicles belonging to the employer in accordance with the procedure and to take care of the materials delivered to him for the performance of the work.
In this regard, it is necessary for the employer to take certain measures in order to ensure both the safety of the workers, workplace safety and the fulfillment of the work as it should be, and the employer is legally authorized to monitor in order to ensure these issues.
However, at this point, it should be noted that although the employer is legally obliged and authorized to monitor, the employer should be prevented from abusing this issue and an order should be observed in which it is prioritized to carry out the personal data processing activities with camera systems for legitimate purposes without harming the fundamental rights and freedoms of the employee, in accordance with the privacy expectations, in connection with the purpose for which they are processed, limited and measured, and to take technical and administrative measures regarding data security.
III. EVALUATIONS WITHIN THE SCOPE OF PERSONAL DATA PROTECTION AUTHORITY
Pursuant to the LPPD, as a rule, data processing activities can be carried out with explicit consent subject to clarification. However, in some exceptional cases stipulated in the law, data may be processed without explicit consent. However, in any case, the data processing activity must comply with the principles specified in Article 4 of the LPPD; (i) Lawfulness and fairness,(ii) Being accurate and kept up to date where necessary. (iii) being processed for specified, explicit and legitimate purposes, (iv) Being relevant, limited and proportionate to the purposes for which they are processed,(v) being stored for the period laid down by relevant legislation or the period required for the purpose for which the personal data are processed.
As stated above, pursuant to Article 5 of the LPPD; as a rule, personal data cannot be processed without the explicit consent of the data subject. However, in the presence of one of the following conditions, it is possible to process personal data without the explicit consent of the data subject:
a) It is explicitly stipulated in the laws.
b) It is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid.
c) It is necessary to process personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of a contract.
d) It is mandatory for the data controller to fulfill its legal obligation.
e) It has been made public by the data subject himself/herself.
f) Data processing is mandatory for the establishment, exercise or protection of a right.
g) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
In this respect, based on the evaluations within the scope of labor law mentioned above, it is possible to process general and special categories of personal data for many purposes such as fulfilling the obligations within the scope of ensuring the occupational health and safety of the employees, controlling the production processes, protecting the workplace and the customer, determining the identity of the employee, preventing unauthorized persons from entering dangerous areas, evaluating the performance of the employee and clarifying the suspicion of crime. In this framework, first of all, it is necessary to evaluate whether the processing of images with cameras by the data controller is special or general personal data processing.
As a rule, taking images through cameras is subject to explicit consent, and the employer must inform the employee in detail and obtain his/her explicit consent. This disclosure should be clear, easily understandable, detailed and inclusive about the locations, viewing angles and distances of the security cameras, the number of cameras, whether they record sound, how long they record, between which hours they record, where and for how long the recordings are kept, the destruction period and the destruction procedure of the recordings. Otherwise, the employer, as the data controller, will be deemed to have failed to fulfill the obligation of disclosure as stipulated in the LPPD, and even if consent is given by the employee, the consent given will be deemed invalid because the obligation of disclosure has not been fulfilled. This will render the entire data processing activity unlawful and the employer will be at risk of legal and criminal sanctions.
However, if the employer processes biometric data at the same time as camera recordings as a data processing activity, in other words, if the cameras use a technology that has the feature of biometric data processing (iris recognition, face recognition, retina recognition, etc.), this will constitute a special quality personal data processing activity, and this situation should also be stated in the clarification text and the explicit consent text should also and specifically include that special quality personal data can be processed. In terms of this processing activity, compliance with the above-mentioned principles is examined more meticulously and strictly. In other words, if there is no compelling reason to process biometric data, other methods should be used. In the precedent decision of the Personal Data Protection Board, this issue is emphasized as follows;
"Even if the personal data processing activity carried out by using a face recognition system at the entrance and exit of the workplace is carried out based on explicit consent, these data processing activities must be carried out in accordance with the general principles regulated in Article 4 of the Law in any case,within this framework, the data controller's purposes within the framework of occupational health and safety can be achieved through alternative means such as magnetic card system, RFID tag, entering an SMS to be sent to the mobile phone into the system during entry-exit, In addition, while it is possible to prevent malicious use by warning workers not to use methods such as signing for someone else or reading a card, and by determining the sanctions that can be applied when detected and informing the workers about this issue, the facial recognition data, which is the biometric data of the employees, is processed, as a result, the processing of more and more intrusive personal data than necessary, contravenes the obligation to comply with the principle of "being connected, limited and proportionate to the purpose for which they are processed" in the processing of personal data regulated in subparagraph (ç) of paragraph (2) of Article 4 of the Law, which can be achieved and carried out by processing personal data that is limited and less likely to interfere with the personal rights of the persons concerned,"
As another point, although the employer may carry out monitoring activities as the data controller, considering that employees have a reasonable expectation of privacy in terms of changing rooms, toilets, showers, prayer rooms, rest rooms and breastfeeding rooms, data processing activities carried out by the data controller in these areas may be considered as an invasion of their private areas, which may damage their privacy expectations.
In addition, recording with a security camera can be associated with the situation that "Processing of data is necessary for the legitimate interests pursued by the datacontroller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject." and makes it relatively mandatory in terms of proving and protecting the legitimate interests of the employer, who is the data controller, in cases such as the safety of the workplace, the safety of the workers, the safety and non-damage of the work equipment, the proof of fault in cases of justified termination, the proof of fault in work accidents, etc.
IV. IN CONCLUSION
- The issue of monitoring and recording the personnel working in workplaces and especially in high-risk field areas with security cameras can be considered as an obligation in terms of ensuring both the safety of the workers, workplace safety and the proper performance of the work in accordance with the labor law legislation. In this respect, it is important to comply with the procedures and conditions stipulated by the LPPD in order to fulfill this obligation.
- Workers should be given clear, easily understandable, detailed and comprehensive information about the location, viewing angles and distances of the security cameras, the number of cameras, whether they record sound, how long they record, between which hours they record, where and for how long the recordings are kept, the time and method of destruction of the recordings. It is important for proof that this information is in writing. This information may be given to the workers as a written text at the time of recruitment or afterwards, or it may be given through a board, sign or warning letter positioned at a point where everyone can easily see and read in the workplace and field area.
- If the cameras used have a technology with biometric data processing feature (iris recognition, face recognition, retina recognition, etc.), this will constitute special categories of personal data processing activity, and this situation should also be stated in the clarification text and the processing of special categories of personal data should also and specifically be included in the explicit consent text.
- However, recording with a security camera can be associated with the situation that "Processing of data is necessary for the legitimate interests pursued by the datacontroller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject." which is one of the situations where data can be processed without seeking explicit consent in Article 5 of the LLPD. " and makes it relatively mandatory in terms of proving and protecting the legitimate interests of the employer, who is the data controller, in cases such as the safety of the workplace, the safety of the workers, the safety and non-damage of the work equipment, the proof of fault in cases of justified termination, the proof of fault in work accidents, etc. For this reason, in the event of a possible dispute and/or complaint, although a defense can be made based on this exceptional data processing issue, there is still a risk that the Authority may impose a criminal sanction for violation. In order to eliminate this situation, the disclosure text and explicit consent elements must be completed completely and duly.
- If all the above-mentioned principles are complied with, the fact that the face of the employees is not blurred does not constitute a violation on its own, and if the obligation to inform is fulfilled, explicit consent is duly obtained and the collected personal data is processed in accordance with the principle of proportionality, taking security camera footage with a visible face will constitute a lawful data processing.
- Taking images through security cameras at the workplace must be carried out in strict compliance with the legal regulations on the protection of personal data. Managing this process in compliance with the provisions of the LPPD is inevitable both in terms of protecting the rights of employees and fulfilling the legal obligations of employers. The use of camera systems to ensure security in the workplace will be possible by raising awareness on the protection of personal data and fulfilling all legal obligations required in this process.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
