As the Law Firm of Attorney Arb. Billur Güler Aslım, we are aware of the difficulties that businesses operating in Antalya face in terms of protecting personal data. In this article, we will discuss the importance and scope of the explicit consent requirement in the processing of employees’ personal data and the issues that need to be taken into consideration in practice. Within the framework of the Law on the Protection of Personal Data No. 6698 (KVKK), we will explain in detail the legal obligations you must comply with when processing your employees’ data.
Processing of Personal Data and the Concept of Explicit Consent
The KVKK numbered 6698 has introduced comprehensive regulations on the processing of personal data. Personal data refers to any information relating to an identified or identifiable natural person. The processing of personal data covers all operations performed on data, such as obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, either fully or partially by automatic means or non-automatic means provided that it is part of any data recording system. The processing of personal data of employees may be necessary for legitimate purposes such as the establishment and execution of an employment contract, occupational health and safety. However, the KVKK states that the processing of personal data is subject to certain conditions. One of these conditions is obtaining the explicit consent of the data owner for the processing of the data.
When is Explicit Consent Required for Processing Employee Personal Data?
Explicit consent is the consent given by the data subject, of their own free will, in an informed and clear manner. The requirement for explicit consent is not always required for the processing of personal data of employees. The KVKK stipulates various legal grounds for the processing of personal data. Explicit consent is only one of these grounds. The requirement for explicit consent is *not* required in the following cases: * It is explicitly provided for in the laws: For example, your explicit consent is not required for the processing of your tax identification number due to tax legislation. * It is mandatory for the establishment or performance of a contract: Explicit consent is not required for the processing of data such as your name, surname, and Turkish identity number within the scope of an employment contract. * It is mandatory for the data controller to fulfill its legal obligation: The employer is obliged to process certain data due to labor law and other relevant legislation. * It is mandatory for the establishment, exercise or protection of a right: For example, processing of personal data may be required for the examination of a claim regarding your employee. * It is mandatory for the legitimate interests of the data controller: This is valid provided that it does not harm the interests and fundamental rights and freedoms of the data subject. For example, using security cameras to ensure safety in the workplace.
How to Obtain Explicit Consent?
Explicit consent must be obtained in a specific and informed manner. This means that the employee is clearly aware of the purpose for which their personal data will be processed, how it will be processed and for how long. Consent can be obtained by means of a pre-prepared form or contract or electronically. However, the consent text must be understandable, easily accessible and clear. The employee's right to withdraw consent must also be clearly stated. Consent cannot be obtained through coercion, pressure or deception. The employee may withdraw consent at any time. Withdrawal of consent does not invalidate any subsequent transactions. However, in the event of withdrawal of consent, the continuation of the employment contract may not be possible.
Matters to be Considered in the Processing of Personal Data of Employees in Antalya
Businesses operating in Antalya are obliged to comply with all provisions of the KVKK. When processing employees' personal data, it is essential to comply with the principles of transparency, accountability and data security. Businesses must determine their policies regarding the processing of personal data, inform their employees about these policies and take the necessary measures to ensure the security of the data. In addition, in the event of a data breach, there is an obligation to notify the relevant institutions and data owners. The processing of employees' personal data in Antalya is strictly regulated by the KVKK numbered 6698. Explicit consent is one of the conditions required for the processing of personal data, but it is not always necessary. It is of great importance for employers to act in accordance with the KVKK and to fulfill the explicit consent condition correctly when processing their employees' personal data. As Atty. Arb. Billur Güler Aslım Law Firm, we provide legal consultancy services to businesses in Antalya regarding KVKK compliance. If you have any questions or needs regarding the protection of your personal data, do not hesitate to contact us.