The general principles for the processing of personal data stipulated in Article 4 of the Law No. 6698 on the Protection of Personal Data play a fundamental role in data protection practice. These principles include compliance with the law and good faith, accuracy and up-to-dateness of data, processing for specific, explicit and legitimate purposes, being relevant, limited and proportionate with the purpose, and duration of retention. Each principle is critical to the protection of personal data and aims to ensure that data processing processes are carried out in a transparent, fair and effective manner. Processing data in accordance with the law, complying with the rules of good faith and avoiding unnecessary data processing operations are mandatory to protect the rights of data subjects and ensure data security. The application of these principles as a whole increases the security of personal data, while at the same time ensuring that data processing activities comply with legal and ethical standards. Within the scope of this information note, the recent decision of the Personal Data Protection Board (“Board”) dated 24/08/2023 and numbered 2023/1461 (“Decision”) on taking video and audio recordings by an educational institution through a camera will be evaluated.
The following points were mentioned in a nutshell in the petitions of complaint regarding the case subject to the Decision:
• A meeting was held between the data controller and the data subjects due to a rent dispute. Subsequently, the data controller sent a notice stating that the video and audio recordings of the data subjects were taken. The data controller stated that it is a legal right granted to him to take the video and audio recordings of the data subjects without the explicit consent
and approval of the data subjects.
• The data subjects stated in their notice to the data controller that taking video and audio recordings without their explicit consent constitutes a crime in accordance with Articles 133 et seq. of the Turkish Criminal Code (“TCC”).
Within this context, while the Board has concluded that there is no violation of the Personal Data Protection Law No. 6698 (“Law”) in certain matters, the Board has concluded that an investigation should be initiated for certain matters. Below are the matters that are not deemed to be in violation of the Law and the grounds for the Board to initiate an investigation.
Matter Covered by the Law:
• Processing of personal data by means of a camera within the framework of occupational health and safety due to the fact that the data controller is at a workplace; data processing is mandatory for the data controller to fulfill its legal obligation under subparagraph ç of
paragraph 2 of Article 5 of the Law and data processing is mandatory for the legitimate interests of the data controller under subparagraph f, provided that it does not harm the fundamental rights and freedoms of the data subject. Therefore, the specified matter is not included in the scope of the review.
Grounds for the Board to Initiate an Investigation:
• Failure of the data controller to fulfill its obligation of disclosure
• Evaluation of the fact that the camera recording contains both video and audio recordings and the audio recording is evaluated within the scope of the principle of “connected,
limited and proportionate to the purpose for which they are processed”.
Defense of the Data Controller:
According to the defense of the data controller; camera systems installed for security purposes in educational institutions at pre-school, primary and secondary school levels perform both video and audio recording. These systems are located in the public areas of the school, especially in front of the garden entrance and building doors, and there is also a camera in the founder’s room.
The real estate used as a school is rented from the data subjects. Therefore, there is a tenancy relationship between the data subjects and the data controller. Within the framework of the rental relationship, audio and video recordings were taken during the rental payments in the school and it was stated that the lessor did not ask for payment documents. However, the lessor requested additional payments and the lessor stated that the recordings were not unauthorized and did not constitute a violation of Article 133 of the TCC. This article stipulates that personal conversations must be non-public and recorded by persons who are not parties to the conversation for the offense to occur. Therefore, it was stated that this was not the case in the present case. It is also stated that the data controller has less than 50 employees and therefore is not obliged to create a VERBIS record, and that the records received are for evidential purposes only and therefore cannot be given to the lessor. It was also stated that there is no legal relationship with the other data subject and personal data is not processed. As a result, it was emphasized that the records were taken within the legal framework and are evidential.
The Board’s Decision No. 2023/1461 dated 24/08/2023:
In the defense from the data controller, it was stated that both audio and video recordings were made for security purposes at the school. However, upon examining the relevant legislation, it was found that only specific areas are permitted for video recording, and the use of cameras is prohibited in some areas. Additionally, there is no specific regulation that legitimizes audio recording. Video recording with cameras does not always constitute a legitimate necessity. For personal data to be processed in accordance with the Law, it must be impossible to achieve the intended purpose of video recording through other reasonable means. Moreover, if such recordings conflict with individuals’ fundamental rights and freedoms, the reasons for recording must carry a superior interest. Considering security and occupational health requirements of educational institutions, it was emphasized that video recording is solely sufficient and that adding audio recording is problematic from a personal data protection perspective. According to the decisions of the Personal Data Protection Board, video recording alone is deemed sufficient for processing personal data, and audio recording does not provide a necessary legitimate interest. It was stated that audio recording constitutes a serious interference with the rights to personal data protection and that the necessity of audio recording in addition to video recording was not justified. Consequently, it was concluded that the data controller’s practice of audio recording was in violation of the Law, while video recording was in compliance. Therefore, further examination was deemed necessary to determine whether the disclosure obligation had been fulfilled. It was noted that the burden of proof regarding the fulfillment of the disclosure obligation lies with the data controller, and no proof had been provided in this regard.
A Similar Decision on Matter
The Board’s decision dated 12/03/2020 and numbered 2020/212 is related to the use of security cameras with audio recording features by a public institution. The decision emphasized that the right to personal data protection is a fundamental right and can only be processed in cases specified by law or with the explicit consent of the individual. Restrictions must be in accordance with Article 13 of the Constitution, ensuring that they do not infringe upon the essence of the right and are compatible with democratic societal order. It was highlighted that audio recordings, which aim to gather information in addition to what can be obtained from video recordings, may violate the right to personal data protection and thus may be contrary to the principle of proportionality.
CONCLUSION
Board’s decision dated 24/08/2023 and numbered 2023/1461 concluded that the data controller’s practice of audio recording is in violation of the Law. It was determined that audio recordings infringe upon the right to personal data protection and are contrary to the principle of proportionality. The audio recording was considered as an unnecessary intervention that increased the information that could be obtained from the video recording and therefore an administrative fine of 200,000 TL was imposed. Video recordings were considered legitimate under specific conditions; however, the data controller was found to have failed to fulfill the disclosure obligation, leading to an additional fine of 30,000 TL. A total fine of 230,000 TL was imposed, and the data controller was instructed to destroy the unlawful audio data. This decision underscores the importance of adhering to the principle of proportionality in the processing of personal data and conducting data processing activities within the legal framework.
Considering that the Board’s approach on this issue is now quite clear, we reach the conclusion that data controllers should interpret the principle of proportionality more carefully in their tasks falling within the scope of the Law. In fact, it is necessary to decide whether to install applications containing qualified personal data such as face recognition and fingerprint systems, which have recently increased in use in workplaces, by taking into account the principle of proportionality with this approach, and in case of installation, it is necessary to pay special attention to the fulfillment of the obligations of disclosure and explicit consent.
