Author: Murat Develioglu
Introduction
Per Article 1 of Law No. 6698 on the Protection of Personal Data, the purpose of the Law is to protect the fundamental rights and freedoms of individuals, especially the confidentiality of private life within the scope of processing personal data, and to establish the obligations, procedures, and principles to be followed by natural and legal persons who process personal data. According to the same Law, personal data means all kinds of information regarding an identified or identifiable natural person. Names, e-mail addresses, phone numbers, health conditions, websites visited, correspondences are examples. On the other hand, the concept of processing personal data means any action taken with respect to data, such as obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, rendering available, classifying, or preventing their usage and, in general terms, processing without complying with the conditions stipulated under the Law on the Protection of Personal Data, is considered as an unlawful process.
The protection of employee’s personal data within the scope of service agreements is also secured under the the aforementioned law, as well as the Turkish Criminal Code, the Turkish Code of Obligations, and the Constitution of the Republic of Turkey.
In this context, the question as to whether the employer is allowed to process an employee's e-mails; that is, whether he/she may process employee's personal data and, if so, under what conditions arise in the decision of the Constitutional Court dated 12.01.2021, which we discuss, below.
The Incident Discussed in the Decision of the Constitutional Court
In the incident subject to the decision of the Constitutional Court, the employer of a private bank examined the contents of the corporate e-mail account of its employee and terminated his employment by citing the correspondences read in the e-mail as the reason. In summary, as the grounds for termination, the employer claimed that the employee violated his primary duty by engaging in commercial activities in a business registered to his spouse during working hours and, to prove this, along with some other evidence, the employer relied on corporate e-mail correspondences of the employee.
The employee (the applicant), applied to the Constitutional Court on the grounds that his right to request protection of his personal data within the scope of confidentiality of private life and freedom of communication were violated.
Conditions for the Employer to Monitor the Employee's E-mails According to the Decision of the Constitutional Court
In the present case, the Constitutional Court stated that for disputes that arise due to the use of communication tools and equipment, such as computers, internet and e-mail, which are provided by employers who wish to benefit from technological developments, a balance should be established between the interests of the employer and the fundamental rights and freedoms of the worker. In summary, the Court came to the following conclusions:
- In principle, the employer may monitor the communication tools provided to the employee and set certain restrictions for their use within the scope of the management authority. However, this authority is limited to a certain degree necessary to operate the business, to ensure order and safety in the workplace and not to violate the essence of the fundamental rights and freedoms of the employer. Therefore, it does not entrust the employer an unlimited and absolute surveillance and monitoring authority over the communication tools.
- Whether there are legitimate reasons that justify monitoring the communication tools and content provided by the employer for the use of the employee should be established.
- Monitoring communication and processing personal data should be carried out transparently and, in this respect, the employees should be informed, in advance, by the employer of the process. The employees should be informed of the legal basis and purpose of the processing of personal data, the scope of the monitoring and data processing, the period of storage of the data, the rights of the data owner, the results of the monitoring and processing, and the possible beneficiaries of the data. In addition, the information provided to the employees should also include the limitations stipulated by the employer regarding the use of the communication tools.
- The intervention by the employer to the right to request protection for personal data and freedom of communication of the employee should be related to the aim to be achieved and be convenient for this aim.
- In order to consider the employer’s intervention in the employee’s right to request protection for personal data and freedom of communication to be necessary, the intervention must be compulsory for the purpose of the monitoring, with the condition that the same results cannot be accomplished by other means, which requires less personal data to be processed, or to be processed less intensely.
- In order to consider the employer’s intervention in the employee’s right to request protection for personal data and freedom of communication to be proportional, data that is going to be processed by monitoring, or somehow utilized, should be limited by the purpose, and any limitation or intervention that surpasses the purpose should not be allowed.
- It is necessary to control whether the conflicting interests and rights of the parties are balanced fairly, considering the effect of the monitoring of the communication on the employee, as well as the consequences.
Conclusion of the Constitutional Court Regarding the Case
According to the Constitutional Court that stipulated the above-mentioned conditions in the case at hand, the employer has a large number of employees and provides corporate financial services, processes personal data by creating a corporate e-mail account, and keeps the communication flow under control for the purpose of ensuring that the business runs properly and as intended. The Court considers rendering a corporate e-mail account accessible for monitoring the communication flow and content, constitutes a legitimate interest for the management of the workplace and is a convenient method to achieve the intended purpose. However, the employment contract of the applicant regulates that the corporate e-mail may only be used for business purposes, allows the bank administration to monitor the corporate e-mail without any notice, forbids the employee to object, and requires the employee to follow the instructions. The employment contract explicitly established termination if the employee violates his/her obligation under the employment contract, such as using the corporate e-mail for purposes other than business, underperformance or violation of the prohibition of having another job. In other words, the applicant was clearly notified, in advance, that the corporate e-mail was accessible for monitoring, and was also notified about the procedure of monitoring through the employment contract, and the applicant gave his explicit consent. The Constitutional Court concluded that the scope of the employee’s intervention was limited to the correspondence supporting the claim that the applicant has another job and proving his claims before the Court. For these reasons, the Court ruled that the employer conducted monitoring within the scope of the purpose, and used the data obtained in accordance with the purpose. In summary, the Court decided that the right to request protection for personal data within the scope of right to respect to privacy was not violated.
