When we analyze the relationship with protection of personal data and the labor law; on one side, the employer’s efforts to select the appropriate personnel in job applications in order to employ qualified personnel suitable for the job requirement of the information of the chosen employee’s education, where did the employee worked in the past and what was the works he/she did ,its medical problems and judicial records; on the other side job security and surveillance of work areas with a camera to increase job safety and productivity at work, precautions taken at entrances and exits, records kept on the computer; and on the other side the inability of the employee to say no to the requested personal data to the employer due to its dependence on the employer increases the importance of the issue that employees acting on behalf of the employer, who will be accepted as data controllers, must be trained on personal data and the establishment of a system that will ensure security.

The identity, address, and job information of the workers, whether they are married or not, their date of birth, citizenship status, criminal record, health information about disease, political or trade union activities, e-mail correspondence, religion, race, ethnicity, and sexual preference are covered by information regarding the personal data. The personal data of the employees are being processed, being used and in some cases it can be shared with third parties in order to fulfillment of obligations provided by the law by employers, employee training, occupational health and safety, control of customer relations, use in promotions.

           There is a regulation on the content and form of the employment contract in Article 8 of the Labor Law. The employment contract under the article is not subject to a special form, unless otherwise specified in the Law. Employment contracts with a duration of one year or more must be made in writing. In cases where the contract will be made in writing, it is understood that its essential elements should be recorded like the parties of the contract, the scope of the fee, etc.  and in this case, personal data should be shared. In paragraph 5/2 (c) of the Personal Data Protection Law, it is regulated that personal data may be processed without seeking consent if “Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.”

            In article 75 of the Labor Law titled as ‘Personnel file of the employee’ it is regulated that: The employer shall arrange a personnel file for each employee working in his establishment. In addition to the information about the employee’s identity, the employer is obliged to keep all the documents and records which he has to arrange in accordance with this Act and other legislation and to show them to authorised persons and authorities when requested. The employer is under the obligation to use the information he has obtained about the employee in congruence with the principles of honesty and law and not to disclose the information for which the employee has a justifiable interest in keeping as a secret.  With Article 75 of the labor law, the employer is obligated to keep the information about the employee’s identity in a file.

            In article 25 of the Labor Law titled as “The breaking of the employment contract by the initiative of the employer (summary termination)” it is stated that: The employer may break the contract, whether for a definite or indefinite period, before its expiry or without having to comply with the prescribed notice periods, in the following cases like; if the Health Committee has determined that the suffering is incurable and incompatible with the performance of the employee’s duties or if the employee has contracted a disease or suffered an injury owing to his own deliberate act, loose living or drunkenness and as a result is absent, and the employer can reach the data within this purpose.  In the same article ; if, when the contract was concluded, the employee misled the employer by falsely claiming to possess qualifications or to satisfy requirements which constitute an essential feature of the contract, or by giving false information or making false statements the employer may break the contract; in this context the employer can request to be informed about the essential elements of the agreement and request personal data such as education status, degree status, licances, previous places he/she worked etc. 

            In Article 419 of the TCO (Turkish Code of Obligations) No. 6098 it is regulated that “The employer may use the personal data of the employee only to the extent that it is mandatory for the employee’s predisposition to work or for the performance of the contract. The provisions of the special law are reserved.”. The current regulation in the law is in line with the principle that personal data regulated in the Personal Data Protection Law 4/2 (ç) “The following principles shall be complied within the processing of personal data:… Being relevant, limited and proportionate to the purposes for which they are processed.” In accordance with Article 419 of the TCO, the employer will be able to process the personal data of its employees to the extent that it is mandatory for the performance of the agreement and to the extent that it is related to the employee’s predisposition to the relevant job. Within this context, the personal data belonging to the parties directly related to the making and the performance of a contract may be processed without the need for explicit consent. In addition, it is also possible that the processing of personal data about employees will be determined as a legitimate interest of the employer in the presence of a suspicion of misconduct in an investigation by the employer.  TCO no. 6098 Article 63 regulates that an act may not be considered an unlawful and unfair act if there is a superior interest, and if data processing is mandatory for the legitimate interests of the data controller in accordance with the regulation contained in Article 5/2-(f) of the Law no. 6698, it is possible to process personal data without explicit consent. But in this case fundamental rights and freedoms of individuals should not be harmed. According to Article 417 of the Turkish Code of Obligations No. 6098, the employer is obligated to protect and respect the personality of the employee in the relationship and to ensure an order in accordance with the principles of honesty at work.

            The Constitutional Court made a decision in the Individual Application numbered 2013/4825 about the issue that the corporate e-mail accounts of the applicants, who work in a private company, containing personal mails were examined by the employer and this mails were used as evidence in the appeal against termination; this act violates the right to demand respect for his/her private and family life and secrecy of communication of applicants. “ It is seen from the case files that the e-mails between the applicants were submitted to the authorized persons or bodies of the defendant Company by a third party outside the case; after that the employer examined the corporate email accounts, and the agreements were terminated with different grounds, starting from the fact that the elements contained in the e-mails obtained were contrary to the employment contracts.……… Due to the provisions contained in the employment contracts signed by the applicants and the employer, it is observed that the applicants accept the internal regulation about the rules to be followed at work, the basic regulation, the orientation booklet, the travel regulation, the instructions and procedures as an integral annex and part of the relevant contracts and oblige themselves to comply with all these regulations……..it shows that especially with the Information Security Commitment that applicants accept; they are under an obligation to their employers that they will not use the computer assigned to them by the company for work, e-mail, use of internet, telephone, communications program, other IT (Information Technology) recources and communication devices to the extent that they exceed the necessary needs for personal purposes, for entertainment purposes, in violation of general morality, customs and traditions; it is seen that they have also made a statement of acceptance and given a commitment that, without notice and without warning to the applicants by corporate executives, they can always keep track of the IT and communication resources they use, e-mails and communication records can be backed up, reported, examined in detail if necessary, confiscation and restriction of use may be imposed……In addition, the employer examined the corporate e-mail accounts of the applicants, and this was done in the belief of confirming the truth of the claim that the applicants’ behavior was contrary to the Company’s regulations after learning about the e-mail submitted to the Company management by the ex-wife of the second applicant. Determining in this direction, considering the provisions of Law No. 4857 and the regulations contained in employment contracts, it was concluded that the employer who examined the e-mails of the applicants in order to verify whether the corporate e-mail accounts are used for personal purposes and in accordance with the Basic Regulation has a legitimate purpose, and the intervention carried out by the employer is measured for this legitimate purpose, these issues are taken into account in the grounds of decisions made by the Courts of Instance……..It must be decided that the applicants’ right to demand respect for private and family life guaranteed in Article 20 of the Constitution and the right to secrecy of communication guaranteed in Article 22 of the Constitution have not been violated, as it is understood that obligations have been fulfilled in terms of protecting constitutional guarantees by creating relevant and sufficient grounds by the Courts of Instance, and the contents of e-mails have not been made public in the proceedings carried out during the judicial processes.”^[4]

            In the event of the termination of the contract grounding; the continuous recording of the workplace and the workers by cameras that are placed in the workplace, the Court of Cassation Department 22 stated in its decision no. 2017/21857 E., 2019/9884 K. dated 07.05.2019 that “It is always possible for the employer to monitor and follow the employee electronically as a result of the managament rights of the employer. However, for this, it is essential that the employee is informed. Failure to inform the employee that he/she is being monitored or secretly monitored should be considered unlawful, even if the data obtained as a result of this monitoring clearly indicate that the employment contract has been violated by the employee. However, it should be accepted that it is not possible to assert that the information obtained as a result of secret monitoring by the employer as a valid reason for termination in a case. While the court should have concluded that the termination was not based on a valid reason and that the plaintiff was entitled to Pay in lieu of notice (notice pay), the decision to dismiss the case with written justification was erroneous and the decision had to be overturned for this reason.”

            Monitoring of workers by biometric methods and closed circuit television systems and keeping records of their personal data can also create serious problems. For example, a person’s fingerprint has a unique quality that distinguishes it from all other individuals. Keeping such information, which is closely connected with the personality of an individual, on record and transferring it to third parties can lead to serious problems. For this reason if these and similar methods are used to record issues such as entry-exit hours to work it is importante to determine the principles to be applied. Even in cases where the application is carried out in accordance with the law, deficiencies related to data security may cause damage to the right of the employee to the protection of its personal data.