İş İlişkisinde Kişisel Verilerin Korunması

Abstract

Due to their unique characteristics, employment contracts are distinguished from contracts under the law of obligations, where the principle of equality prevails. This situation arises from the fact that while the employee is dependent on the employer economically and personally, the employer has the right to manage and instruct. The weak position of the employee vis-à-vis the employer can lead to a violation of the right to protection of personal data, which has begun to be established and shaped as a legal concept in recent years. Although there is no special regulation for the protection of personal data in employment relations, Personal Data Protection Law No. 6698, which came into force on April 7, 2016, has been the basic guiding regulation in this regard. In addition, national and international regulations, case law, and decisions made by the Personal Data Protection Board also serve the purpose of protecting the employee's personal data. In our study, firstly, the basic concepts of data protection law, such as personal data, data processing, relevant person, and data controller are explained, and then the legal regulations in our country and internationally in this field are examined. Subsequently, the basic principles that the employer must comply with when processing the employee's personal data and that are stipulated under Personal Data Protection Law No. 6698 are concretized and explained. As a matter of fact, in practice, it is observed that employers engage in various data processing activities without adhering to these principles, citing only the employment relationship as a justification. Finally, in our study, the data processing activities commonly seen in employment relations are discussed, their legality is evaluated, and the legal and criminal sanctions that the employer may face in the event of unlawful data processing are explained.

Especially due to developments in technology and easier access to information, it is seen that employers engage in immoderate and excessive data processing activities. In this context, it is important to raise awareness among both employees and employers about their rights and obligations and to ensure that they act accordingly.