A Noteworthy Principle Decision of the Personal Data Protection Board on the Use of Biometric Data 04 June 2026

The Principle Decision of the Personal Data Protection Board (the "Board") dated 29 April 2026 and numbered 2026/921 was published in the Official Gazette dated 2 June 2026. The Decision contains important assessments regarding the use of fingerprint, facial recognition and similar biometric systems for employee attendance and working hours tracking.
 

In recent years, there has been an increase in the use of biometric identification systems such as fingerprint, facial recognition, iris, and retina scanning for the purposes of digitalization of employee attendance tracking and enhancing workplace security. In its published Principle Decision, the Board emphasizes that the use of biometric data for working hours tracking purposes should be regarded as exceptional in terms of personal data protection law.
 

1. Assessment of the Legal Basis

In the Principle Decision, the Board acknowledges that employers are under an obligation to record working hours pursuant to the Labour Law No. 4857; however, it emphasizes that there is no explicit legal regulation requiring such obligation to be fulfilled through biometric systems. Accordingly, it is stated that the legal basis of the processing of biometric data for working hours tracking purposes must be separately assessed.
 

2. Approach Regarding the Validity of Explicit Consent
 

The Principle Decision states that, taking into account the imbalance of power between the parties to the employment relationship it must be assessed on a case-by-case basis whether the explicit consent obtained from employees is freely given. It is further noted that doubts may arise regarding the validity of explicit consent in situations where the employee does not have a real and effective choice to refuse consent or withdraw previously granted consent.
 

The Board further noted that the withdrawal of explicit consent may directly affect the continued operation of biometric systems in practice and concluded that relying solely on the condition of explicit consent for the processing of biometric data for the purpose of tracking working hours would not constitute a sufficient legal basis in most cases.
 

3. Principle of Proportionality and Alternative Methods
 

One of the key foundations of the Principle Decision is the principle of proportionality. The Board has reiterated that the least intrusive method must be preferred in personal data processing activities in order to achieve the intended purpose.
 

When assessed in terms of the purpose of working hours tracking, the following are noted as existing alternative methods:
 

• Encrypted card or PIN-based systems,
   

• ID cards based on RFID/NFC technology,
   

• Traditional signatures and attendance sheets,
   

• Entry and exit records maintained under supervisory oversight

The Board considered that attendance and working hours tracking serves a limited administrative purpose, that the processing of biometric data for this purpose would in most cases fail to meet the principle of proportionality, and that the same result could be achieved using less intrusive methods.
 

4. An Approach Consistent with Judicial Decisions
 

The Board's assessments are consistent with established judicial precedent on the matter.
 

In its decision dated 10 March 2022, the Constitutional Court examined an application concerning the use of a fingerprint system for working hours tracking in a municipality and ruled that the right to the protection of personal data had been violated due to the absence of clear statutory provisions governing the scope, limits and safeguards applicable to the use of biometric data.
 

Similarly, in a dispute concerning working hours tracking via a palm vein reader system, the 12th Chamber of the Council of State stated that the processing of biometric data must be assessed in terms of the criteria of necessity and proportionality; this decision was also upheld by the Plenary Session of the Administrative Law Chambers of the Council of State.
 

5. Conclusions and Assessment
 

The Board's Principle Decision establishes that practices involving the processing of biometric data for attendance and working hours tracking purposes should be reassessed in light of the legal grounds and general principles set out under the Personal Data Protection Law ("KVKK").
 

The decision particularly emphasises that biometric data processing activities carried out for the purpose of tracking working hours entail significant risks in terms of the data processing conditions set out in Article 6 of the Law and the principle of proportionality set out in Article 4. For this reason, it is important for employers to review their current practices and, where possible, opt for less intrusive alternative methods.

The Board also emphasised that the approach adopted in the Principle Decision should be taken into consideration in practice and stated that, where practices are found to be contrary to the principles set out therein, administrative sanctions may be imposed on data controllers pursuant to Article 18 of the Personal Data Protection Law.
 

Accordingly, institutions and organisations using biometric data for employee attendance and working hours tracking are advised to review their existing practices in light of the KVKK, the Board's decisions and relevant judicial precedents, reassess potential compliance risks, and implement the necessary compliance measures.