Protection of personal data from the perspective of employees and employers
Attorney Melek Özyurt
Data, in other words information, is the most important source of power in the digital age. Personal data has become one of the main attributes of a person's mental and physical existence.
Today, the security of personal data is part of personal security, and regulations have been adopted and measures taken in this field. As a result, personal data law now has an impact on many areas of our lives.
In the course of the employment relationship, the employer obtains and uses certain personal data of the employee.
The employer's duty of care toward the employee is a requirement of the rule of law. The employee's personal data, together with his or her material and moral interests, falls within the scope of the employer's duty of care. Personal data enjoys constitutional protection. The matter is also regulated in detail by the Personal Data Protection Law No. 6698 (KVKK).
Every individual has the right to the protection of personal data. On the other hand, the employer needs access to the employee's personal data as part of its right to obtain information. A fair balance must therefore be struck between employee and employer.
1. What is personal data?
Under KVKK No. 6698, personal data means “any information relating to an identified or identifiable natural person” (Article 3(d)). Everything concerning an employee's private life (for example, gender, language, religion, race and email correspondence) is personal data.
Under Article 3(e) of KVKK, processing of personal data is defined as “any operation performed on personal data, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, takeover, making available, classification or preventing the use thereof, carried out fully or partially through automatic means or through non-automatic means provided that the data forms part of a data filing system.”
2. What should be considered when processing personal data?
Article 20 of the Constitution provides that “Personal data may be processed only in cases prescribed by law or with the explicit consent of the person.”
In addition, personal data may be processed only in accordance with certain principles. Under the relevant KVKK provision, personal data must be processed lawfully and in good faith, be accurate and kept up to date where necessary, be processed for specified, explicit and legitimate purposes, be relevant, limited and proportionate to the purposes for which it is processed, and be retained only for the period laid down in the relevant legislation or necessary for the purpose of processing.
The erasure, destruction or anonymization of personal data is regulated in Article 7 of KVKK. The provision reads: “(1) Even if it has been processed in accordance with this Law and other relevant laws, personal data shall be erased, destroyed or anonymized by the data controller, ex officio or upon the request of the data subject, once the reasons requiring its processing no longer exist. (2) Provisions in other laws concerning the erasure, destruction or anonymization of personal data are reserved. (3) The procedures and principles for the erasure, destruction or anonymization of personal data shall be set out in a regulation.”
The same procedures and principles apply to the transfer of personal data.
What is the employer's legal liability?
The Personal Data Protection Board, which has public legal personality, was established to protect personal data.
In addition, KVKK imposes a number of obligations on the employer as data controller. First, an employer, whether a natural or legal person, must register with the Data Controllers Registry (VERBİS) before starting to process data. The employer must also take all technical and administrative measures to prevent the unlawful processing of personal data and to safeguard the data.
The employer may also authorize another person so that personal data can be processed more easily. In that case, the employer bears legal and criminal liability, jointly with the person or persons it authorized, for any damage arising from any operation, including the protection, preservation and destruction of personal data.
What legal remedies are available to the employee?
The rights an employee may have regarding his or her own personal data are set out in Article 11 of KVKK. Accordingly, the employee has the right to:
“a) learn whether his or her personal data is being processed,
b) request information if his or her personal data has been processed,
c) learn the purpose of processing and whether the data is used in line with that purpose,
ç) know the third parties in Türkiye or abroad to whom the personal data has been transferred,
d) request correction if the personal data has been processed incompletely or inaccurately,
e) request erasure or destruction of the personal data under the conditions set out in Article 7,
f) request that the operations carried out under subparagraphs (d) and (e) be notified to the third parties to whom the personal data has been transferred,
g) object to an outcome detrimental to him or her that arises from the analysis of the processed data exclusively through automated systems,
ğ) claim compensation for damage suffered as a result of the unlawful processing of personal data.”
The employee may submit these requests to the employer or to the person the employer has authorized. Requests do not have to be made in writing, but for purposes of later proof they should preferably be submitted in writing or online. The data controller must conclude the request within 30 days at the latest, free of charge unless the operation involves a separate cost. Whether the request is accepted or rejected, the employee is notified in writing or electronically, together with the reasons.
An employee whose request is rejected may file a complaint with the Board within 30 days of learning the response of the employer or its authorized person, and in any event within 60 days of the application date. Note that a complaint cannot be filed before this application route has been exhausted.
In addition, if the employee's personality rights are violated, remedies such as the following are available:
- Prevention of the infringement (attack), and communication of the resulting decisions to third parties and their publication,
- Pecuniary and non-pecuniary damages, another form of redress instead of non-pecuniary damages, or such redress in addition to damages,
- Discrimination compensation or union-related compensation,
5. Invalidity of the employment contract, termination of the contract by the employee for just cause, compensation and
many other legal remedies.
Moreover, where personality rights are violated, those responsible may be punished under criminal law and administrative fines may be imposed on them.
It should be remembered that personal rights may be restricted with the consent of the other party, where there is an overriding private or public interest, or where an authority granted by law is exercised.
Furthermore, the circumstances in which personal data may be processed without the employee's consent are set out in detail in Article 5 et seq. of KVKK.