Video Surveillance in the Workplace

Technology has transformed how employers exercise their management rights. In the past, supervisors, foremen, and managers acted as the eyes of the employer. Today, cameras placed throughout the workplace serve as the employer’s eyes and ears. However, every technological advancement comes with responsibility: Employers, who now have easy access to employee data and can conduct more frequent monitoring, must carefully balance their legitimate interests with the fundamental rights and freedoms of employees. The right to privacy and the right to request the protection of personal data, as enshrined in the Constitution, are also safeguarded in the workplace.

Employers may opt to install cameras for purposes such as ensuring workplace safety, monitoring employee performance, and improving productivity. However, this practice involves the processing of personal data, including employees’ images and voices. In this article, we will examine the legality of workplace surveillance via cameras, considering the provisions of the Law on the Protection of Personal Data No. 6698 (“Law”).

Sensitive Data and Voice Recording

The first step is to determine whether the personal data accessed by the employer through surveillance activities is classified as sensitive. If the data is indeed sensitive, the conditions for processing data under the Law will change. At this point, it is crucial to assess whether the cameras are processing biometric data, which is considered sensitive. For example, if the cameras have facial recognition feature, they are processing biometric data. Even if explicit consent is obtained from employees, biometric data processing will be considered unlawful where enhanced security is not required. (For detailed information on this topic, refer to our article on Biometric Attendance Systems)

Due to its uniqueness in harmony, tone, and pitch, voice may be considered biometric data. If voice is processed as biometric data, the data processing activity could be deemed unlawful.[1] This is because processing sensitive personal data (biometric data) requires compliance with at least one of the conditions outlined in Article 6 of the Law. In this regard, there is no specific legal provision that allows the recording of voice data at any stage of the employment contract. As a general rule, voice recording is not required for employers to meet their occupational health and safety obligations. Even if the employer obtains explicit consent from the employee, the processing of this data could violate the principle of proportionality, as the employer can achieve their objectives (ensuring occupational health and safety, monitoring productivity) through less invasive means.

While the Personal Data Protection Board (“Board”) does not classify voice as biometric data, it has emphasized that even if only voice recordings are processed, "constantly recording communication between individuals would constitute a severe violation of several fundamental rights and freedoms, particularly the right to privacy, as well as the protection of a person's material and moral well-being."[2]

While processing only voice recordings can render the data processing activity unlawful, using cameras that process both voice and visual data—when such processing is not necessary—would clearly be unlawful. According to the Board's decision dated 12.03.2020, “if the intended benefit can be achieved through video recording without audio, the inclusion of audio recording will disturb the balance between the purpose of the personal data processing activity and the means employed, thus violating the principle of proportionality.”[3] This is because processing both video and audio data represents a deeper intervention into the essence of the right. In such cases, the data subject may feel as though they are constantly under surveillance.

Conditions for Data Processing

When a camera processes only general image data, the employer must base their data processing activity on at least one of the conditions outlined in Article 5 of the Law. In the sample guidance provided by the Personal Data Protection Authority (“Authority”) in the Guideline on Fulfilling the Obligation to Inform (“Guideline”), the employer relies on the legal grounds of "necessity for the data controller to fulfill a legal obligation" and "necessity for processing data for the legitimate interests of the data controller, provided it does not infringe upon the fundamental rights and freedoms of the data subject.”[4]

Under Article 4 of the Occupational Health and Safety Law No. 6331, the employer:

(i) monitors and oversees compliance with occupational health and safety measures, and
(ii) takes necessary precautions to prevent individuals, other than those who have been adequately informed and instructed, from entering areas with life-threatening or special risks.

Similarly, Article 417 of the Turkish Code of Obligations No. 6098 mandates that the employer protect the employee's personality, show respect for the employee, and maintain an honest and fair work environment. The employer is also required to take necessary measures to prevent employees from being subjected to psychological or sexual harassment, and to prevent further harm to those who have already experienced such harassment. Camera surveillance may be considered essential to meet these legal obligations in the technological age. However, recordings made via cameras do not necessarily justify a legitimate interest in all cases.

For data processing to be lawful, the purpose requiring recording must not be achievable through less intrusive methods.[5] This is a position affirmed by the Council of State: Camera systems represent a significant intervention in the private social life of employees, including aspects of their work relations. Therefore, camera surveillance should only be employed as a last resort.

Purpose of Data Processing: Security or Efficiency?

The conditions for data processing should be evaluated in conjunction with the employer’s intended purpose. Has the employer installed cameras in the workplace for occupational health and safety, or to monitor employee performance? The purpose is key, as there must be a balance between the employer's objective and the means used to interfere with employees’ privacy.

The Board has deemed camera surveillance for occupational health and safety purposes legally acceptable, as long as the employer meets the obligation to inform and implements necessary data security measures. The placement of cameras for security purposes is therefore crucial. The Council of State has clarified that surveillance of entrances, exits, surrounding walls or fences of service buildings, corridors linking buildings and units, open and closed parking lots are legally permissible.[6] The Guideline includes examples where cameras are placed at entrances, building facades, cafeterias, dining areas, visitor waiting rooms, parking lots, security booths, and corridor areas.[7] However, surveillance in areas where employees have a reasonable expectation of privacy—such as changing rooms, break areas, nursing rooms, toilets, showers, and mosques—constitutes an invasion of privacy.[8] In one instance, the Board classified images from a mosque as "sensitive personal data" due to their religious nature, imposing a TRY 300,000.00 fine on the employer who installed the camera there.[9]

It is not clear whether using camera systems for performance or productivity monitoring is legally permissible. The Board’s decision summaries contain no ruling that supports the use of camera systems for monitoring employee efficiency. The Council of State, in a ruling regarding camera systems at the Eskişehir Tax Office Directorate, noted that cameras should not be installed to continuously monitor specific individuals, as this would violate privacy rights.[10]

In its reference to the Antovic and Mirkovic v. Montenegro case[11], the Council of State found that cameras installed in university lecture halls for safety and monitoring purposes were an unlawful invasion of privacy. Lecture halls are part of the private social life of teaching staff, and monitoring educational activities does not constitute a valid legal reason for processing personal data. Furthermore, no evidence of a threat to life or property was presented to justify the surveillance. The activity subject to the case violated the right to privacy.

Obligation to Inform

Employers must fulfill the obligation to inform when processing data based on legal grounds, ensuring that data processing is linked to the specified purpose and is minimal. The Authority’s Guideline requires employers to disclose details such as the number and location of cameras and which unit oversees the data.

The Board has not issued specific rulings regarding the use of hidden cameras. However, the legality of hidden camera use remains highly controversial, even in cases involving crime suspicion, and requires cautious handling.

Data Security

Under Article 12 of the Law, the employer is obligated to implement all necessary technical and administrative measures to ensure the security of personal data obtained through surveillance. The Council of State, in one of its decisions, emphasized the importance of ensuring the security and confidentiality of the recordings, and that access to the footage is restricted to authorized individuals, security procedures are prepared.

Conclusion

In conclusion, employers should:

• avoid using cameras that process sensitive data or record voice unless there is a specific necessity for security.
• evaluate data processing conditions and objectives in compliance with the Law, the Board’s decisions, and the Council of State’s rulings.
• follow the principle of data minimization at all stages to ensure the minimum amount of data is used for maximum benefit.
• place cameras only in areas with significant workplace traffic to ensure occupational health and safety.
• avoid over-surveillance that could lead employees to feel constantly monitored.
• address performance monitoring cautiously, opting for less intrusive methods (e.g., performance reviews) first, and if necessary, camera systems should be used only when a clear need is demonstrated.
• respect employees’ privacy and social lives, ensuring that reasonable expectations of privacy are met.
• fulfill the obligation to inform and ensure data security.

References

(Only in Turkish) 10th Chamber of the Council of State, 2019/11036 E., 2021/44 K. Numbered Decision. (2021, 01 11). Retrieved from Lexpera: https://www.lexpera.com.tr/ictihat/danistay/10-d-e-2019-11036-k-2021-44-t-11-1-2021

(Only in Turkish) Guideline on Fulfilling the Obligation to Inform. (2025, 03). Retrieved from Personal Data Protection Board: https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/a569a068-c079-4189-b134-f57bc727af7d.pdf

(Only in Turkish) Summary of Decision No. 2020/212 of the Personal Data Protection Board. (2020, 03 12). Retrieved from Personal Data Protection Board: https://www.kvkk.gov.tr/Icerik/6892/2020-212

(Only in Turkish) Summary of Decision No. 2022/797 of the Personal Data Protection Board. (2022, 08 04). Retrieved from Personal Data Protection Board: https://www.kvkk.gov.tr/Icerik/7434/2022-797

(Only in Turkish) Summary of Decision No. 2023/1356 of the Personal Data Protection Board. (2023, 08 10). Retrieved from Personal Data Protection Board: https://www.kvkk.gov.tr/Icerik/7779/2023-1356

(Only in Turkish) Summary of Decision No. 2023/1461 of the Personal Data Protection Board. (2023, 08 24). Retrieved from Personal Data Protection Board: https://www.kvkk.gov.tr/Icerik/7783/2023-1461

(Only in Turkish) Summary of Decision No. 2023/1461 of the Personal Data Protection Board. (2023, 08 24). Retrieved from Personal Data Protection Board: https://www.kvkk.gov.tr/Icerik/7783/2023-1461

(Only in Turkish)10th Chamber of the Council of State, 2015/2787 E., 2018/775 K. Numbered Decision. (2018, 02 20). Retrieved from Lexpera: https://www.lexpera.com.tr/ictihat/danistay/10-d-e-2015-2787-k-2018-775-t-20-2-2018

Arıcı Şirin, T. (2023). (Only in Turkish) Processing of Personal Data within the Framework of Business Management and Planning. Expert View on Personal Data Protection.

European Court of Human Rights Judgment in Antovic and Mirkovic v. Montenegro. (2018, 02 28). Retrieved from European Court of Human Rights : https://hudoc.echr.coe.int/fre#{%22itemid%22:[%22001-178904%22]}