ASSESSMENT OF THE PRINCIPLE DECISION REGARDING THE PROCESSING OF BIOMETRIC DATA FOR TIME AND ATTENDANCE TRACKING PURPOSES
The Personal Data Protection Board (the “Board”), through its Principle Decision dated 29 April 2026 and numbered 2026/921, has made significant assessments regarding the use of biometric identification systems by employers for monitoring employees’ attendance and working hours and has set forth the principles applicable to such practices.
The Principle Decision was published in the Official Gazette dated 2 June 2026 and numbered 33268 and entered into force on the same date. It is of particular importance in terms of assessing the legal basis, the requirement of explicit consent, and the principle of proportionality with respect to fingerprint recognition, facial recognition, iris scanning, and similar biometric systems that are widely used in workplaces.
Through the Principle Decision, the Board not only emphasized the nature of biometric data as special categories of personal data but also addressed in detail the impact of the imbalance of power inherent in the employer-employee relationship on the validity of explicit consent.
Legal Nature of Biometric Data and Conditions for Processing
Article 6 of the Personal Data Protection Law No. 6698 (the “Law”) classifies biometric data as special categories of personal data. This category of data, which has been exhaustively determined by the legislator, is subject to stricter protection mechanisms compared to ordinary personal data.
Although the Law does not provide a comprehensive definition of biometric data, such data is generally understood as data derived from individuals’ physical, physiological, or behavioural characteristics that enables identification. Fingerprints, palm vein patterns, retina and iris data, as well as facial recognition data, fall within this scope.
The Board emphasized that biometric data carries higher risks compared to other personal data, as it cannot be altered or revoked once compromised, and therefore requires a heightened level of protection.
Assessment of Reliance on Explicit Consent for Time and Attendance Tracking
In its assessment, the Board noted that obligations relating to the monitoring of working hours are regulated under Labour Law No. 4857 and the relevant legislation. However, there is no explicit statutory provision requiring or permitting such monitoring to be carried out through the processing of biometric data.
Accordingly, it has been observed that, in practice, biometric data processing activities carried out for time and attendance tracking purposes are predominantly based on the explicit consent of the data subject.
Pursuant to Article 3 of the Law, explicit consent is defined as consent relating to a specific matter, based on information, and expressed through free will. Therefore, for explicit consent to be considered legally valid, all three elements must be present simultaneously.
However, the Board emphasized that, by its very nature, the employer-employee relationship does not place the parties on an equal footing and involves an imbalance of power in favour of the employer. Considering concerns that an employee’s refusal to participate in biometric data processing activities or the subsequent withdrawal of consent may affect the employment relationship, the Board stated that there are serious doubts as to whether such consent can genuinely be regarded as freely given.
For this reason, the Board concluded that, as a rule, reliance solely on explicit consent does not constitute a sufficient legal basis for the processing of biometric data for time and attendance tracking purposes.
Assessment in Terms of the Principles of Proportionality, Necessity, and Data Minimisation
One of the most notable aspects of the Principle Decision is the assessment of biometric data processing activities within the framework of the general principles set out under Article 4 of the Law.
Pursuant to Article 4 of the Law, personal data must be processed in a manner that is relevant, limited, and proportionate to the purposes for which it is processed. The Board emphasized that, for a data processing activity to be considered lawful, it is not sufficient merely to rely on one of the legal grounds for processing; compliance with the general principles is also required.
Within this framework, the Board stated that the following factors must be assessed separately with respect to the processing of biometric data for time and attendance tracking purposes:
• Whether the processing activity is necessary to achieve the intended purpose;
• Whether less intrusive methods capable of achieving the same result are available; • Whether the impact of the processing activity on the fundamental rights and freedoms of the data subject is proportionate.
The Board noted that alternative methods such as password-protected card systems, PIN-based systems, RFID/NFC cards, signature sheets, and supervised manual entry systems are widely available and used in practice.
Accordingly, it was concluded that the processing of biometric data is, in most cases, not necessary for achieving the limited administrative purpose of time and attendance tracking and, given the existence of alternative methods, does not satisfy the principle of proportionality.
Impact of the Constitutional Court and Council of State Decisions on the Principle Decision
The Board also made extensive reference to the relevant decisions of the higher courts in the Principle Decision.
In its decision dated 10 March 2022 and numbered 2018/11988, the Constitutional Court examined the use of a fingerprint recognition system for monitoring the attendance of a civil servant employed by a municipality. The Court held that the right to protection of personal data had been violated on the grounds that there was no explicit statutory basis regulating the fundamental principles governing attendance monitoring through biometric data processing.
The Court further emphasized that any interference involving the processing of special categories of personal data may only be considered legitimate where it is supported by an adequate legal basis.
Furthermore, in the decision of the 12th Chamber of the Council of State numbered 2021/3870 Merits and 2023/2548 Decision, the use of a palm vein recognition system for attendance tracking purposes was found to be unlawful.
This decision was subsequently upheld by the Plenary Session of the Administrative Law Chambers of the Council of State, which confirmed that biometric data processing activities must be assessed within the scope of the principle of proportionality set out under Article 4 of the Law.
The Principle Decision adopted by the Board follows an approach consistent with these judicial precedents and leaves only a very limited scope for the use of biometric data for time and attendance tracking purposes.
Implications for Employers
The Principle Decision has significant implications for employers who use biometric systems to monitor employee attendance.
In line with the Board’s assessment, it appears highly difficult to establish the lawfulness of biometric data processing activities carried out for time and attendance tracking purposes in the absence of an explicit statutory provision authorising such practices.
Furthermore, the Board’s position that explicit consent obtained from employees cannot, by itself, be regarded as a sufficient legal basis necessitates a reassessment of fingerprint recognition and facial recognition systems that have been widely used in practice for many years.
In this respect, it is important for employers to:
• Review their employee attendance monitoring systems;
• Adopt alternative systems that do not require the processing of biometric data; • Prefer solutions that comply with the principles of data minimisation and proportionality;
• Update their personal data protection compliance processes.
Otherwise, data controllers may be subject to administrative sanctions pursuant to Article 18 of the Law.
CONCLUSION
The Principle Decision numbered 2026/921 establishes an important implementation framework by bringing together the judicial precedents developed to date regarding the processing of biometric data for time and attendance tracking purposes and the fundamental principles of data protection law.
In particular, the Decision emphasizes that, due to the imbalance of power inherent in the employer-employee relationship, explicit consent cannot always be regarded as freely given, that the processing of biometric data may only be justified in exceptional circumstances, and that the principle of proportionality cannot be satisfied where alternative methods are available.
Accordingly, it is of great importance for employers to reassess their employee attendance monitoring practices and to prefer less intrusive methods instead of biometric identification systems, both in terms of ensuring compliance with the Law and preventing potential administrative sanctions.