Decision on Use of Fingerprint Shift Tracking Systems

The Personal Data Protection Board (“the Board”), with the Principle Decision dated 29.04.2026 and numbered 2026/921 published in the Official Gazette dated June 2, 2026, made an important decision regarding the processing of biometric data in workplaces for the purpose of shift tracking. The Board explicitly emphasized in the decision that explicit consent from employees does not constitute a sufficient legal basis alone for processing fingerprints in shift tracking.

• Damage to Explicit Consent in an Employment Relationship: Due to the structural power imbalance between employees and employers, it is not legally possible to accept that the consent given by the employee always relies on "free will". In addition, the fact that explicit consent is revocable at any moment does not comply with the legal sustainability of shift tracking systems that must operate continuously.

• The Principle of Proportionality Beyond Explicit Consent and Alternative Methods: The Board stated that even if the employee gives a valid explicit consent, the data processing activity must meet the criteria of suitability for the purpose, appropriateness, and proportionality. Employers must first try alternative methods that interfere less with individual fundamental rights and freedoms. These include encrypted card or PIN-based systems, traditional signature sheets, RFID/NFC identity cards, or manual entry under supervisor control. Processing biometric data before using these alternatives clearly violates the proportionality principle.

• Balance of Interests and the Supremacy of Biometric Data: Biometric data, such as fingerprints and facial recognition, are special categories of personal data whose recovery and reversal are impossible if compromised or misused. On the other hand, shift tracking is a legitimate but limited and ordinary administrative purpose for the employer. The Board placed the high legal interest in protecting the data above the administrative interest that shift tracking will bring.

This decision serves as a strong compliance warning for employers who use biometric attendance tracking systems. In order for employers not to face high administrative fines and legal sanctions, it is important that they create a transition plan to alternative systems and handle data storage and destruction processes within the framework of KVKK obligations.