In the event, which is the subject of the Turkish Constitutional Court with application No. 2018/11988 and decision dated 10.03.2022, the Applicant works as a civil servant within the Municipality of Söke ("Municipality"). Working hours in the Municipality are tracked by fingerprint system. Despite the Applicant's objections, the case has been brought to the court of first instance, as the fingerprints continued to be taken by the Municipality.

The court of first instance decided to annul the administrative act with the acceptance of the case. In the reasoning of the decision, it is stated that the controlling of employee's working hours by fingerprint scanning system should be evaluated within the scope of the processing of personal data within the scope of the right to respect of private life, by referring to the relevant legislation. The court of first instance also stated that there is no detailed legal regulation regarding the tracking of working hours of civil servants, and that having a legal basis for restriction of fundamental rights is a constitutional obligation and at the same time one of the basic principles in the European Convention on Human Rights.

The Regulation on the Protection and Processing of Data Within Social Security Institution ("SSI") ("Regulation")entered into force after being published in the Official Gazette dated 02.19.2022 and No. 31755. Within the scope of this Regulation, the procedures and principles to be followed in the processing of the personal data obtained by the SSI is determined.

What are the Highlights of the Regulation?

In the Communiqué on the Procedures and Principles Regarding the Personnel Certification Mechanism published in the Official Gazette dated 06.12.2021 and numbered 31681, it has stated that those who want to entitled as Data Protection Officer should firstly have a "participation certificate" and in this context, the procedures and principles would be stated and published by Turkish Personal Data Protection Board ("Board").

It is stated that as a result of the investigation of the Authority within the scope of the notices submitted to the Authority, the software provided by the software firms to the automobile renting companies and the negative experiences of the rent holders during their automobile rental period and the comments of the automobile rental companies for the next renting processes can be viewed by another automobile renting companies in the rental situation, and the lessor is not aware of the processing of this knowledge.

It is stated that once an evaluation is made case-by-case basis between the fundamental rights and freedoms of the person and the legitimate interests of the data controller, the blacklist application is applicable within the data controller company, but if the processed personal data is shared with the other firms, the fundamental rights and freedoms of the data subject will be violated, and commitment to the purpose, limitation and it has been evaluated that is incompatible with the principle of proportionality. In the Decision, it is also stated that the processing of personal data within the scope of the blacklist will prevent the data subject from exercising their rights since they cannot know other automobile renting companies that their personal data were shared with it.