TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Kübra İslamoğlu Bayer, Simge Yüce and Yiğit Aktimur, YAZICIOGLU Legal
ever, some provisions related to employment privacy are included in diverse laws, such as: • TCO provides that an employer may use an employee’s personal data only to the extent necessary for the employee’s employability or the performance of the employment contract; • Turkish Labour Law obliges employers to handle information obtained about their employees in accordance with the rules of good faith and law and prohibits disclosing any information that the employee has a justi - fied interest in keeping confidential; and • Occupational Health and Safety Law man - dates that health data must be kept confiden - tial to protect the employee’s private life and reputation. Essentially, the general principles of the DP Law apply in the workplace, and controllers must comply with its obligations. However, due to the unique relationship between employers and employees, controllers face certain challenges in practice. Monitoring Workplace Communications In some of its decisions, the DPA specifically addressed the monitoring of employee com - munications in the workplace. Accordingly, an employer is entitled to monitor work comput - ers, work mobile phones, and other electronic devices provided to employees, provided that the following conditions are met: • informing employees in advance (eg, through a privacy notice); • pursuing a legitimate purpose (eg, a compli - ance investigation based on a reasonable doubt); and • observing the principle of proportionality (eg, emails or files should not be opened or reviewed if they are clearly personal).
These principles also apply to the implemen - tation of cybersecurity tools and insider threat detection and prevention programs. The Constitutional Court also addresses this issue in several decisions. For instance, it examined a case where an employer reviewed an employee’s corporate email and used the correspondence to terminate the employment contract. The court noted that the employee’s contract specified that the corporate email was for work purposes only and could be monitored by the employer without prior notice. It empha - sised that the use of the employee’s emails for legal purposes in a judicial process was within reasonable limits and in line with the principle of proportionality. In another decision, the appli - cant’s holiday pictures and emails sent from their corporate accounts were considered evidence in the judgment. Essentially, the Constitutional Court appears to consider the following criteria for employers when monitoring employees’ communication tools: • the terms governing the use of work equip - ment; • employee awareness of these terms; • the proportionality of the interference with employees’ rights; and • whether contract termination is reasonable in light of the employee’s actions. Obtaining Explicit Consent As a general principle, controllers should rely on either the legal bases provided by the DP Law or the data subject’s explicit consent when pro - cessing personal data. However, employees’ explicit consent may not always be considered valid, as employees may
486 CHAMBERS.COM
Powered by FlippingBook