Facts
One of the most frequent subjects of complaints to the Authority was employers turning to biometric identification systems, such as fingerprint, facial recognition, iris and retina scanning, to track staff attendance. In practice such processing was usually based on employees' explicit consent. The Personal Data Protection Board adopted principle decision 2026/921 on 29 April 2026, which was published in the Official Gazette on 2 June 2026. In response to queries from data controllers, the Authority issued a second announcement on 27 August 2026 clarifying the scope of the decision.
Question
Which of the processing conditions in Article 6(3) of Law No. 6698 can support the processing of biometric data for attendance tracking? In particular, given the imbalance of power between employer and employee, can an employee's explicit consent be a valid and sufficient legal basis? The Board also considered whether, even with valid consent, biometric processing meets the proportionality principle in Article 4 when less intrusive methods are available.
Decision
The Board noted that the legislation on recording working hours contains no express provision requiring biometrics, so conditions (b) to (g) of Article 6(3) cannot apply. Because of the power imbalance and the fact that consent can be withdrawn, explicit consent alone was not a sufficient legal basis. The Board decided that even valid consent would not make the processing proportionate, and that attendance must be recorded by other means such as encrypted cards, PINs, paper registers, RFID/NFC cards or supervised manual entry. Breaches will be dealt with under Article 18. The 27 August 2026 announcement confines the decision to attendance tracking and states that converting the data into a mathematical template does not change its biometric nature.
Why it matters
The principle decision turns reasoning from earlier individual cases into a general rule binding every employer. It states plainly that consent will not suffice in an employment relationship and that proportionality is an independent bar. The announcement provides no transition period. Biometric access control in critical security areas falls outside the decision and will be assessed case by case.
Related stages
See the Board's decision 2022/797 of 4 August 2022 fining a factory TRY 500,000 for facial recognition attendance tracking.