Facts
Employees of a paper manufacturer complained to the Authority. They said entry and exit at the factory were controlled by a facial recognition system and that staff had been made to sign a general information and consent form. They also alleged that cameras had been placed near the washrooms to measure time spent in the toilets. In its defence the company said it operated in a hazardous sector and that cameras and access control were needed to meet its occupational health and safety duties and its duty to supervise workers, relying on the Labour Act and the Occupational Health and Safety Act.
Question
Can the processing of biometric data through facial recognition for workplace attendance be based on consent obtained through a general form in an employment relationship, or on duties arising from occupational health and safety legislation? Article 6 of Law No. 6698 treats biometric data as a special category of personal data. The Board also examined whether using biometrics, when less intrusive methods exist, is consistent with the principle in Article 4 that processing must be relevant, limited and proportionate to its purpose.
Decision
The Board held that the consent obtained was not specific, informed and freely given. Since labour and health and safety legislation does not expressly provide for biometric processing, the condition that processing be provided for by law was not met either. The Board added that even valid consent would not cure the breach, because facial recognition was disproportionate where magnetic cards, RFID tags or SMS codes were available. It fined the company TRY 500,000 under Article 18 for breach of Article 12(1), and gave it thirty days to stop biometric processing, destroy the data collected, reposition the cameras and revise its notices.
Why it matters
The decision is a concrete application of the Board's position that biometric attendance tracking in the workplace cannot be legitimised by consent. The Board kept the validity of consent and proportionality apart and treated proportionality as an independent bar. It also declined to treat general duties, such as occupational health and safety, as a sufficient statutory basis for processing special category data. The same reasoning later became a principle decision binding all data controllers in 2026.
Related stages
See the Board's principle decision 2026/921 of 29 April 2026 on biometric attendance tracking.