Administrative Court Decision Regarding the Taking of Personnel Photographs for Attendance Monitoring Purposes

The Eskişehir-Bilecik Medical Chamber Presidency (“Presidency”) requested the removal of the practice of taking photographs of personnel entering and leaving Eskişehir City Hospital (“Hospital”) for attendance tracking purposes, on the grounds that such practice was contrary to the Law No. 6698 on the Protection of Personal Data (“Law”).

The application was rejected by the Hospital, and the reason for rejection was stated as the fact that personnel used collective card scanning systems, making it impossible to accurately determine the exact entry and exit times of each employee.

Following this rejection, the Presidency filed an action before the Eskişehir 1st Administrative Court (“Court”) requesting the annulment of the relevant administrative act. In the lawsuit, the applicant argued that:

• There was no necessity requiring photographs to be taken of Hospital personnel during entry and exit procedures;

• There was no legal regulation in other legislation authorizing the taking of personnel photographs;

• No explicit consent had been properly obtained from the personnel by the Hospital;

• The practice subject to the lawsuit was not limited and proportionate.

In response to the lawsuit, the Hospital requested the dismissal of the case, stating that:

• The Hospital had a large number of employees and encountered situations such as collective scanning of magnetic access cards;

• Identifying which personnel were present and at what times was important for effective operation;

• Effective delivery of healthcare services depended on personnel being present at their workplaces on time;

• Healthcare personnel other than physicians also performed additional duties, physicians were subject to the Civil Servants Law No. 657, and pursuant to the principle of equality, all personnel were included within the scope of this practice;

• The existing practice was connected with its intended purpose and was limited and proportionate;

• Considering that images were already recorded through cameras located at various points within the Hospital, the practice could not be considered an additional data processing activity;

• Personal data was stored only for the period necessary for the purpose for which it was processed, in accordance with the principle of purpose limitation, and the data was deleted periodically.

Decision and Reasoning of the Court

The first instance court stated that the practice carried out by the Hospital constituted data processing within the meaning of the Law. The Court further held that, before evaluating whether the photographs taken constituted biometric data, the dispute should first be examined within the framework of general principles.

The Court assessed that taking photographs of personnel during entry and exit procedures for attendance monitoring purposes should be evaluated under Article 4/2(ç) of the Law, titled “General Principles”.

The Court concluded that there was no proportionality between the public interest intended to be achieved through the practice and the data processing activity carried out. Accordingly, the practice was found to be contrary to the principle of proportionality, and the relevant administrative act was annulled.

Evaluation

As is known, the Law No. 6698 on the Protection of Personal Data aims to prevent unlawful processing of personal data. In this regard, certain principles that must be complied with during personal data processing activities have been regulated. One of these principles is that personal data must be “processed in connection with the purpose for which it is processed, limited and proportionate.”

Within the scope of this principle, the important consideration is that only the amount of data necessary to achieve the intended purpose should be processed, and unnecessary processing of excessive data should be avoided.

The Personal Data Protection Board has previously established a similar approach in one of its decisions, stating that obtaining individuals’ palm print data, which constitutes biometric data, for entrance control purposes at a sports club was incompatible with the principle that personal data must be processed in connection with the purpose, limited and proportionate, as alternative methods could be used to control access to club services.

In this context, it was considered that physical security could be ensured through less intrusive data processing methods instead of collecting biometric data such as fingerprints for entrance control purposes.

Considering that the photographs taken in the administrative court decision mentioned above were not classified as biometric data, it is evident that whether the processed data constitutes special category personal data is not decisive in determining compliance with the principle of proportionality. Even if the photographs subject to the lawsuit are considered ordinary personal data, the processing activity may still be regarded as unlawful and disproportionate.

Accordingly, instead of taking photographs of personnel, alternative and more proportionate data processing methods may be used to ensure attendance monitoring.

Submitted for your information and consideration.