Processing of Special Categories of Personal Data in Employer and Employee Relations

Law No. 6698 on the Personal Data Protection ("Law") stipulates its purpose in Article 1 titled "Purpose" as follows: “The purpose of this Law is to protect fundamental rights and freedoms of persons, particularly the right to privacy, with respect to processing of personal data and to set forth obligations, principles and procedures which shall be binding upon natural or legal persons who process personal data.” This provision regulates how personal data will be processed. Personal data is defined as "any information relating to an identified or identifiable natural person" in subparagraph d of Article 3 of the Law. Personal data are divided into special and general categories. In Article 6 of the Law titled "Conditions for processing of Special categories of personal data", special categories of personal data are defined as follows: "Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data are deemed to be special categories of personal data."

The employment relationship is established between the employee and the employer and is a very important issue. Dependency is a constitutive element for this relationship. The employee becomes dependent on the employer. This relationship, by its very nature, requires the processing of personal data. The employer has to have some information about the employee. Even at the application stage, many data of the candidate employee are obtained by the prospective employer, and the number of these data increases if the recruitment is realised. Since the employee's personnel file must be prepared, information such as name, place of birth, date of birth, marital status, residence, etc. is collected. In addition, criminal record information is usually requested. In addition, health information is also processed by the employer. A lot of different types of information such as the employees's blood type, if any, disorders are recorded by the employer. In addition, information about the employee's family may also be included in this data.

In addition to the personal data that the employer processes compulsorily, there may also be data that the employer processes to use in various activities for purposes such as increasing the motivation of the employee and gaining loyalty to the work. In addition, some data may also arise depending on the employment relationship. For example, wage information, the information of the account in the bank where the wage of the employee will be deposited has emerged depending on the labour relationship.

Considering the definition of the law, it is clear that all these examples include special categories of personal data. For example, criminal record and health information, which are mostly found in employers, are special categories of personal data. In order to process these data, the conditions listed in the law must be met.

It should be added here that the employer has an obligation to take care of the employee. This includes the confidentiality of the employee's private life. Processing the general and especially special categories of personal data of the employee in accordance with the law will also ensure compliance with this obligation. In addition, since personal data is included in the right of personality, protecting this right can also be considered in this context.

While processing the special categories of personal data of the employee, the employer must also comply with Article 4 of the Law entitled "General principles". The first paragraph of this article limits the processing of personal data with the provision "Personal data shall only be processed in compliance with procedures and principles laid down in this Law or other laws." The continuation of the article is as follows;

"The following principles shall be complied within the processing of personal data:

1. Lawfulness and fairness.
2. Being accurate and kept up to date where necessary.
3. Being processed for specified, explicit and legitimate purposes.
4. Being relevant, limited and proportionate to the purposes for which they are processed.
5. Being stored for the period laid down by relevant legislation or the period required for the purpose for which the personal data are processed."

There are conditions and principles to be followed in the processing of special categories of personal data. If an examination is made in line with these principles, it will be seen that information far from the purpose of the employee-employer relationship should not be processed. For example, many employers do not request information on the membership of associations and foundations, which are also included in special categories of personal data. Because this information is not related to most jobs. If another example is to be given, heavy work involving tasks such as lifting loads may pose health hazards. The health data to be requested from the employees in such heavy jobs and who will work in jobs that do not involve heavy hazards such as desk jobs must be different. This is quite natural. Requesting the health data from an employee who works in a desk job would exceed the principle of being relevant, limited and proportionate. In addition, since the race, ethnic origin, political or philosophical thoughts and beliefs of the person are mostly impossible to relate to most jobs, the processing of these by the employer generally contradicts the general principles.

The "explicit consent" referred to here is a concept defined in Article 3 of the Law. Accordingly, explicit consent means "freely given, specific and informed consent". Accordingly, if the explicit consent of the employee is obtained, it is possible to process sensitive data. It is especially important to obtain this consent during the recruitment phase. Employers cannot use this information other than recruitment.

The processing of sensitive personal data will be in compliance with the Law if the employee's personal file contains the explicit consent approval and the signed clarification text.

In cases of actual impossibility, i.e. when it is not possible to obtain explicit consent from the employee for various reasons, it is possible to process sensitive personal data. Reasons such as a health problem that prevents obtaining the explicit consent of the worker, the disappearance of the employee may reveal this situation.

The employee may also have made his/her personal data public himself/herself. An employee who shares the association he/she is a member of on a social media account will have publicised his/her personal data in this regard. In addition, as an even more appropriate example, the employee may have added this information to his/her CV submitted to the workplace. This is also a publicisation.

It may be necessary to process special categories of personal data for the protection, provision or utilisation of certain rights of the employee. This information may be needed for the utilisation of some rights.

Explicit consent will not be sought in cases where persons and organisations under the obligation to keep secrets are required to process sensitive personal data.

For legal obligations in the field of employment, it is counted among the conditions under which special categories of personal data may be processed. Processing of some information may be mandatory for some jobs. No consent will be sought for data that is mandatory to be processed by law. In addition, it may become an obligation to process special categories of personal data in matters related to occupational health and safety.

Organisations with political, philosophical, religious or trade union purposes may also be required to process special categories of personal data.

It would be appropriate to delete the special categories of personal data upon the employee's termination of employment. Because at this point, compliance with the principles of limitation and proportionality may no longer exist. In addition, the purpose of processing may not exist. The legitimate purpose may be considered lost. It should be added that it is almost impossible to keep the personal data of the dismissed employee up to date, and non-compliance with this principle will also arise.

Conclusion

Special categories of personal data are data that are defined separately in the Law and the conditions for processing are stipulated. The new amendment to the Law will create differences in the current situation. Since it will enter into force in June, the amendment to the processing conditions is analysed in this article. The changes it will create in practice can be observed in time and it is expected that the difficulties brought by the previous version of the article will be eliminated.

As the processing of sensitive personal data is extremely important, this issue should be handled carefully in the employee-employer relationship. Processing the special categories of personal data of the employee in the manner stipulated by the Law will protect the rights of the employee and protect the employer from the negative consequences that may arise.

Should you have any queries or need further details, please contact us.