Constitutional Court Decision On Fingerprint Registration System Is Published! 26 April 2022

To summarize the flow of events; the applicant, who works as a civil servant in the Mayor's Office of Söke, applied to the institution, where he works, for the removal of the tracking shift with fingerprint registration system. Upon the rejection of the application by the institution, he filed a lawsuit in the Administrative Court for the removal of the aforementioned administrative action.

The Administrative Court decided to accept the case and then, the institution appealed the decision. The District Administrative Court decided to dismiss with prejudice and accept the appeal.

Then, the applicant applied to the Constitutional Court, claiming that his right to request the protection of his personal data within the scope of the right to respect to privacy has been violated due to the tracking employees' shift with the fingerprint registration system.

Under Article 20 of the Constitution, personal data can be processed if it is stipulated by the law or if the data owner has consented explicitly. Concordantly, in Article 6 of the Law on Protection of Personal Data No. 6698 (“the Law”), some data groups are given a high-level of importance and they can only be processed if the data owner gives the explicit consent or if it is stipulated in another law explicitly. The Constitutional Court emphasized that for the consent to be given to be qualified as "explicit consent" it is necessary to inform the data owner in advance about the scope, purpose, limits, and consequences of the personal data to be processed; there must be a legitimate purpose for processing; there must be no other method for the aim of achieving the legitimate aim with less interference on the protection of personal data and the data should be processed finitely with the purpose. Therefore, it is underlined by the Constitutional Court that even if the processing of personal data is carried out based on the consent of the relevant person and the data is processed for a specific purpose, proceeding by obtaining explicit consent will not legitimize excessive collection of data and, in the light of the principle of proportionality, it will not be compatible with the principle of requesting minimum level data from the data subject. Thus, it has been clarified that the opinion of the Personal Data Protection Authority on this matter is in the same direction.

When the Constitutional Court investigated the relevant legislation, it seems there is a provision for the administration to control the working hours of civil servants and the starting and ending times of daily working hours under the Civil Servants Law No. 657. However, there is no method regarding how to ensure this control. Similarly, in the Municipal Law No. 5393, the authority to conduct the municipal organization has been given to the mayor, but the scope of using this authority has not been determined. In this case, it is concluded that there is no explicit regulation in other laws regarding the processing of biometric data within the scope of tracking employees' shifts.

So, the Constitutional Court decided that the right to request the protection of personal data within the scope of the right to respect to privacy was violated due to the processing of sensitive personal data by the administration without a legal basis, and showed its negative approach to processing of biometric data for purposes such as tracking shifts explicitly.

You can find the full text of the decision at the link below:

https://www.resmigazete.gov.tr/ eskiler/ 2022/ 04/ 20220419-7.pdf