The purpose of the Law No. 6698 on the Protection of Personal Data (“Law No. 6698”) is to protect fundamental rights and freedoms of persons, particularly the right to privacy, with respect to processing of personal data and to set forth obligations, principles and procedures which shall be binding upon natural persons or legal entities who process personal data. The provision of this Law applies to natural persons whose personal data are processed and to natural persons or legal entities processing such data wholly or partially by automated means or by non-automated means which provided that form part of a data filing system. In this article, the processing activities carried out by employers as data controllers will be evaluated based on the employers’ processing of employees’ personal data as part of a data filing system.

Within the scope of the Law No. 6698, the concept of employment relationship is evaluated more broadly. Regardless of the type of their employment contract, all employees, including persons working with an employment contract, employee candidates and those whose employment contract has expired are accepted as data subjects within the scope of the Law No. 6698. At this point, although the subject of all rights and responsibilities attributed to the data controller and data subjects within the scope of the Law No. 6698 is the employer and employee candidate/employee and persons whose employment relations have terminated, the issues that differ in terms of employment relation will be addressed.

First of all, the most important feature that distinguished the employment relationship from other situations is the issue of “loyalty to the employer”. The issue of “loyalty”, which is the most important detail that distinguishes the employee from other data subjects within the scope of Law No. 6698, shows that the position of the employee necessitate the more protection pursuant to the Labor Law and the Supreme Court decisions. Also, the subject of dispute in most of the settled labor lawsuits is whether the employee made the relevant action (resignation, relocation etc.) with their own free will. For this reason, the issues against the employer within the scope of the employment relationship are detailed in the legal regulations rather than being left to the choice of the employees. This situation is also very important within the scope of Law No. 6698, because one of the legal reasons for the processing of personal data is regulated as “explicit consent”. Another thing is that “explicit consent” may be the only preferable reason for legal compliance in the processing of “special categories of personal data”. Within the scope of the Law No. 6698, there are 3 elements of explicit consent and they are as follows:

  • relevant to the particular subject for which data are processes,

  • informed,

  • freely given

However, as explained above, asking for the explicit consent of people who work “loyally” to an employer to process their data is questionable. Because it is both problematic and quite difficult to prove that the will of the employee was freely given while making the said decision. The same situation exists for employee candidate or an employee whose employment contract has terminated. In this relationship where there are financial concerns, the free will, which is one of the elements of explicit consent, will not be possible in most cases or it may be a matter of discussion. On the other hand, many employers would like to process various categories of their employees’ personal data under projects that will serve their workplace’s operations that may necessitate the explicit consent.

Accordingly, first of all, it is necessary to evaluate the conditions for processing personal data that employers can apply for the purposes they want to reach. In this evaluation, the conditions for processing personal data that are “ Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract” and “Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject” often constitute sufficient legal ground for the processing of the relevant data without seeking explicit consent. On the other hand, anonymization of personal data, especially for special categories of personal data, provides an alternative to employers without seeking the “explicit consent” for the processing of personal data. However, in some cases this is not possible, and it may be necessary to process special categories of personal data without anonymization.

In particular, both the Covid-19 tests and health reports became an important part of the agenda during the pandemic period. Since all kinds of data related to the health of the person, including the drugs used, the diseases they had or the vaccinations they had, are considered as special categories of personal data, more special and stricter conditions are regulated regarding the processing of these data. In this context, the major matter in the processing of special categories of personal data is to provide the conditions which are data subject’s explicit consent or being permitted by laws. On the other hand, pursuant to Article 6/3 of the Law No. 6698, personal data concerning health and sexual life may only be processed, without seeking explicit consent of the data subject, by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing. Therefore, for the situations where the employees’ health data needs to be processed, instead of applying for their explicit consent, it is possible for the employer to rely on this regulation.

Especially after a major part of the society was approved to receive the Covid-19 vaccine, an important agenda for employers is the processing vaccinated employees’ related data. According to the Ministry of Health’s statements, the Covid-19 vaccine has not been declared mandatory. Therefore, in principle, employers cannot be forced to get vaccinated and it must be accepted that they have a right to choose. On the other hand, employers have the obligation to maintain a healthy and safe environment in the workplace. Therefore, the related data can be processed by the employers for the purpose of meeting this obligation and regulating the workplace restrictions. However, if employers would not like to seek explicit consent due to above-mentioned risks regarding the validity of explicit consent in the employment relationship, Article 6/3 of the Law No. 6698 is applicable. The most important thing is that the related data must be collected/processed through a workplace or an assigned doctor. Also, it is important that any department except the workplace/assigned doctor cannot access such data. As so, the health data of the employee can be processed without seeking the explicit consent and only with a prior notice. If workplace restrictions are based on the results of this processing activity and some information needs to be shared with other departments, these data should not be related to the details of the health data of identified or identifiable persons. To make this possible, the health data detail can be kept confidential, or the health data can be anonymized. When mentioned methods are followed, processing employees’ Covid-19 vaccine data should be in compliance with the Law No. 6698.