PRINCIPLE DECISION ON PROCESSING BIOMETRIC DATA FOR EMPLOYEE ATTENDANCE TRACKING HAS BEEN PUBLISHED IN THE OFFICIAL GAZETTE

The Principle Decision on the Processing of Biometric Data for Employee Attendance Tracking (“Decision”), issued by the Personal Data Protection Board (“Board”), was published in the Official Gazette dated 2 June 2026 and numbered 33268. The Decision states that the use of biometric data for attendance tracking is, in most cases, incompatible with the principles of necessity and proportionality set out in the Personal Data Protection Law (“Law”). Therefore, employers should primarily resort to less intrusive methods such as card access systems, PIN-based applications, signature records, or similar alternatives. In recent years, the Board has received numerous complaints and reports regarding the use of fingerprint and facial recognition systems for employee attendance tracking. To ensure consistency in practice and to provide guidance to employers on this matter, the Board has issued the aforementioned principle decision.

Definition of Biometric Data Under the Decision

Under the Decision, biometric data is defined as data that uniquely identifies an individual, such as fingerprints, facial recognition data, iris and retina data, and palm vein patterns. Unlike other categories of personal data, biometric data is inherently immutable. Furthermore, since such data cannot be revoked, replaced, or renewed if stolen or misused, its compromise may lead to serious rights violations and security risks, particularly identity theft. For this reason, biometric data is regarded as a sensitive category of personal data requiring enhanced protection.

One of the most significant issues addressed in the Decision is whether an employer may process employees’ biometric data based on the explicit consent obtained from them. Although explicit consent is recognized as one of the legal bases for processing special categories of personal data, the Board emphasized that the employer–employee relationship does not involve an equal balance of power between the parties. Employees may fear losing their jobs, feel pressured in relation to their employer, or encounter difficulties in withdrawing their consent. According to the Board, the mere fact that an employee has provided consent does not, by itself, constitute a sufficient safeguard to legitimize the processing of biometric data.

Application of the Principles of Proportionality and Necessity Under the Decision

The Board’s primary assessment in this regard focuses on whether the processing activity complies with the principles of proportionality and necessity. The purpose of attendance tracking is merely to determine employees’ working hours, including their arrival and departure times. Where this objective can be achieved through less intrusive methods—such as card access systems, PIN codes, RFID cards, attendance sheets, or supervision by security personnel—the direct use of fingerprint or facial recognition systems has been deemed contrary to the principle of proportionality.

The Board emphasizes that personal data processing activities should be guided by the principle of “minimum intervention.” Accordingly, employers are expected to first demonstrate why less intrusive alternatives are insufficient and only consider the processing of biometric data where such alternatives cannot adequately serve the intended purpose. In other words, rather than implementing a biometric system first and subsequently attempting to justify its use, employers must be able to concretely demonstrate why the use of biometric data is necessary from the outset.

Judicial Approach

The Board, in its assessment, relied not only on the provisions of the Personal Data Protection Law but also referred to previous judicial decisions. In particular, judgments of the Constitutional Court and the Council of State have emphasized that the use of biometric data may only be justified where it is genuinely necessary and the intended purpose cannot be achieved through any alternative means.

In one of the examples cited in the Decision, the attendance tracking of a municipal employee through a fingerprint recognition system was examined, and the practice was found to constitute an interference with the right to the protection of private life. In its assessment, the relevant court noted that the objective of attendance tracking could have been achieved through less intrusive methods and therefore concluded that the use of biometric data was neither necessary nor proportionate.

Matters Employers Should Consider Under the Decision

For employers, the most significant implication of this principle decision is that the use of biometric data has not been completely prohibited; rather, it may be considered lawful only under certain conditions.

In this regard, employers must be able to provide satisfactory answers to several key questions in order to justify the processing of biometric data. First, employers must be able to demonstrate concretely why the use of biometric data is necessary and why the same objective cannot be achieved through less intrusive means. In addition, consideration should be given to whether the amount of data processed is limited to what is necessary for the intended purpose, whether employees’ rights and freedoms are adequately protected, and whether any explicit consent obtained has truly been given freely.

According to the Board’s approach, where these considerations cannot be explained and justified in a convincing manner, attendance-tracking practices carried out through the processing of biometric data may be deemed contrary to the Law.

Please let us know if you have any queries.