TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
• Turkish Labour Law obliges employers to handle information obtained about their employees under the rules of good faith and law and prohibit dis - closing any information that the employee has a justified interest in keeping confidential; • Occupational Health and Safety Law mandates that health data must be kept confidential to pro - tect the private life and reputation of the employee. Essentially, the general principles of the DP Law apply in the workplace and controllers must comply with its obligations. However, due to the unique relationship between employers and employees, controllers face certain challenges in practice. Monitoring Workplace Communications In some of its decisions, the DPA addressed the moni - toring of employee communications in the workplace. Accordingly, an employer is entitled to monitor work computers, work mobile phones, and other electronic devices provided to employees, provided that the fol - lowing conditions are met: • informing employees in advance; • pursuing a legitimate purpose; and • observing the principle of proportionality. These principles also apply to the implementation of cybersecurity tools. The Constitutional Court addressed this issue in sev - eral decisions. In one case, an employer examined an employee’s corporate email and used the correspond - ence to terminate the employment contract. The court highlighted that the contract specified the corporate email was for work purposes and could be monitored without prior notice. It emphasised that using the emails for legal purposes in a judicial process was reasonable and proportionate. In another case, holi - day pictures and emails sent from the corporate email were used as evidence in the judgment. Essentially, the Constitutional Court appears to con - sider the following criteria for employers when moni - toring employees’ communication tools: • the terms governing the use of work equipment; • employee awareness of these terms;
• the proportionality of the interference with employ - ees’ rights; and • whether contract termination is reasonable in light
of the employee’s actions. Obtaining Explicit Consent
Employees’ explicit consent may not always be con - sidered valid, as employees may not have complete freedom in their relationship with their employer due to the imbalance of power between the parties. There - fore, controllers should carefully assess whether the requirements for explicit consent are met, particularly for processing activities within an employment rela - tionship. This does not mean that explicit consent obtained from employees will always be deemed invalid. In a decision involving a controller based abroad that obtained employees’ personal data through its liaison office, the DPA clarified that employees’ explicit con - sent for the transfer of personal data abroad may be considered valid, as the employee understands that their data will ultimately be processed by the control - ler abroad. Processing Special Categories of Personal Data Before the DP Law Amendments, the legal bases for processing special categories of personal data were limited, creating challenges for controllers, particularly employers processing health data in an employment context. Especially, the introduction of a legal basis allowing the processing of employees’ health data where “for the fulfilment of legal obligations in the fields of employment” has significantly facilitated the lawful processing of such data by controllers. Background Checks Records related to criminal convictions are considered special categories of personal data under the DP Law. Thus, processing criminal convictions for background checks is considered the processing of special cat - egories of personal data. There is debate over wheth - er employers can process this information based on explicit consent or if it can be processed under the legal basis of “necessity for fulfilling legal obligations in employment”. The DPA’s Guidelines on the Process - ing of Special Categories of Personal Data states that decisions such as criminal convictions, imprisonment,
522 CHAMBERS.COM
Powered by FlippingBook