The data collected through cameras are considered personal data within the scope of the Turkish Law on the Protection of Personal Data, and therefore the lawfulness of such video recording must be evaluated in terms of that Law as well as other relevant legislation. Video recordings for these purposes may be considered a lawful data processing activity, so long as certain obligations under the Law are fulfilled and the principle of proportionality is not exceeded.
Under the data protection law, the general principle is that personal data must not be processed without the explicit consent of the data subject. However, the law provides that in certain cases personal data may be processed without explicit consent.
One of those cases is when the data processing is necessary for the legitimate interest of the data controller. However, in order for this exception to apply, the data processing activity must not harm the fundamental rights and freedoms of the data subject. In this context, in addition to the general principle of proportionality stated in the law, the exception regarding the legitimate interest of the data controller itself contains a proportionality requirement.
It is generally permissible to use video recording for the purpose of ensuring the physical security of the workplace and occupational health and safety under this exception, as it is within the scope of the legitimate interest of the employer. However, the processing activity must not violate the fundamental rights and freedoms of the employees, in this case primarily the employees’ right to privacy.
For camera recording that complies with these limitations, no explicit consent will be needed. However, if the data will be transferred abroad, there will be an obligation to obtain explicit consent regarding the transfer.
As mentioned above, one of the basic principles under the data protection law is that personal data must be relevant, limited and proportionate to the purpose for which they are processed.
Accordingly, even if one of the legal grounds for processing of personal data is applicable, the processing activity must not go beyond its stated purpose, and it should not be carried out in a way that exceeds that purpose. In this respect, for example, the installation of camera devices in the employees’ individual offices, in addition to the common areas of the workplace, would be considered contrary to the principle of proportionality, as it would exceed the purpose of ensuring security in the workplace and it could cause concern among employees that they are under constant surveillance. Moreover, such a practice may also constitute an interference with the right to privacy.
Another important point regarding this subject is stated in a 2020 decision of the Turkish Data Protection Authority. In that decision, the Authority stated that in cases where the expected benefit of the recording can be obtained with video recording only (i.e. without audio recording), making an audio recording violates the principle of proportionality, as it will disrupt the balance between the personal data processing activity and the purpose to be achieved.
Even if camera recording at the workplace falls within the legitimate interest exception and the processing is carried out in accordance with the principle of proportionality, the employer is required to inform the data subjects about the camera recordings.
Specifically, the employer is required to inform employees and third parties (e.g. visitors) whose data is being collected through camera recordings about the identity of the data controller, the method of collecting personal data, the legal reason, the purpose of processing, the third parties to whom the data may be transferred, and the rights of data subjects under the law.
Under the Data Protection Authority’s guidelines, the obligation to inform can be fulfilled in a ‘layered’ manner in areas where camera recordings are made. The Authority defines layered information as ‘informing the data subject about the acquisition of personal data in a short, understandable, clear and simple method during the acquisition of personal data, and directing the data subject to a channel that the data subject can access after this information within the scope of the information in Article 10 of the Law.’
For example; the following information can be provided in the area where camera recording is made: ‘Camera recording is made in this area for security purposes. You can access our information notice on the processing of your personal data from X link / our website.’ In this way, data subjects are briefly informed about the existence and purpose of camera recording and are directed to a different channel to obtain more detailed information.
The use of camera recording by employers for the purposes of security and occupational health and safety in the workplace will be deemed compliant with the data protection law, provided that:
While video recording may be necessary to protect employers’ legitimate interests, it is important to avoid arbitrary practices that may amount to impermissible interference in the private lives of individuals.
For more information about employee data privacy
