Employer's Obligations Under the KVKK During the Coronavirus Pandemic Period
With the increasing number of people contracting the coronavirus pandemic, which started in China and showed its effects worldwide in a short time, various measures have been taken in many areas in our country. In particular, employers are implementing certain measures for employees in order to prevent any harm in terms of occupational health and safety.During this process, is it possible to implement measures taken at workplaces without observing the obligations regulated in the Personal Data Protection Law due to the extraordinary situation we are in? Can health data obtained as a result of the measures be processed without consent? We will try to answer some frequently asked questions on this subject.First of all, it should be noted that; although we are going through an extraordinary period with a very serious global pandemic, employers' obligations arising from the ''Personal Data Protection Law and Secondary Legislation'' (KVKK) continue during the implementation of measures. What obligations of the employer continue pursuant to the KVKK?
The obligation to inform continues.
''KVKK Article 10. Obligation of the Data Controller to Inform'' regulates the obligation to inform under this heading, and pursuant to this article, the data controller is obligated to inform the data subject about the data processing activity at the time personal data is obtained.Here, the ''data controller'' is the employer, and the data subject must be informed about the identity of the data controller, which data will be processed for which purpose, the methods of obtaining data, to whom and for what purpose the data may be transferred, and all matters regarding the rights of the data subject.In this case, if health data obtained during the implementation of measures against the coronavirus pandemic, such as temperature screening at workplace entry and exit, asking certain questions regarding health status, and other similar precautions, are to be processed, the ''Obligation to Inform'' must first be fulfilled by employers.
In order to process data relating to health status, the employer must additionally obtain explicit consent from the data subject.
Article 6 of the KVKK regulates the "Conditions for Processing Special Categories of Personal Data," and the relevant provision is as follows;(1)Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and clothing, association, foundation, or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data constitute special categories of personal data.(2) Processing of special categories of personal data without the explicit consent of the data subject is prohibited.As can be seen from the provision, health data falls within the scope of special categories of personal data, and in order to process special categories of personal data, the employer must first obtain the explicit consent of the data subject for the processing of data. Although actions are taken with the aim of preventing the spread of the pandemic, an incorrect perception should not be formed that the employer's existing obligations under the KVKK would not need to be fulfilled in this situation. It is not possible for all kinds of measures to be implemented and health data to be processed without any restrictions under the pretext of pandemic precautions without complying with these obligations.In this case, during the implementation of measures taken by the employer due to the coronavirus pandemic, in addition to the employer's obligation to inform, the explicit consent of the relevant data subject must also be obtained in order to process the data obtained as a result of these implementations. The health data of employees who have not given their explicit consent must not be processed under any circumstances.
Health data may be processed by persons with a duty of confidentiality without seeking the explicit consent of the data subject.
Article 6/3 of the KVKK provides an exception to the explicit consent requirement, and pursuant to this article, health data may be processed without seeking the explicit consent of the data subject only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, and the planning and management of health services and their financing, by persons under the obligation of confidentiality or by authorized institutions and organizations.As can be seen, health data may be processed for certain purposes by doctors, nurses, health personnel, and other persons with a duty of confidentiality, even without the explicit consent of the data subject. In this case, if the measures against the coronavirus pandemic are implemented by a physician present at the workplace, informing the employees about this situation will be sufficient, and since the workplace physician has a duty of confidentiality, the explicit consent of the data subject will not be separately required. However, this is only applicable when the employer cannot access the health data under any circumstances; in cases where the employer can access this data, explicit consent must also be obtained. The point to note here is that even though explicit consent is not required for a measure to be implemented by the workplace physician, the obligation to inform must have been fulfilled prior to implementation. To summarize with an example; since one of the most common and well-known symptoms of the disease is high fever, temperature screening of employees or visitors at workplace entry and exit is one of the most frequently encountered precautions at workplaces these days. In line with the above explanations, if the temperature screening is to be performed by the workplace physician, fulfilling the obligation to inform will be sufficient and there will be no need to obtain separate explicit consent. However, at workplaces without a workplace physician, explicit consent must also be obtained, in addition to informing, prior to temperature screening and other applications.
When processing data, attention must be paid to whether the data is relevant to, limited to, and proportionate with the purpose, and where necessary, the data must be deleted or anonymized.
Article 4 of the KVKK requires that personal data processed must be relevant to, limited to, and proportionate with the purpose for which they are processed. Therefore, data that exceeds the purpose, is unrelated to the subject, and whose disclosure would not serve any public interest should not be processed under the pretext of precautionary measures. For this reason, data to be processed within the scope of coronavirus measures must have been obtained for the purpose of preventing the spread of the virus in the workplace. Article 7 of the KVKK stipulates thatpersonal data must be deleted ex officio or upon request when the reasons requiring their processing cease to exist. In this case, data processed within the scope of measures during the coronavirus pandemic period must no longer be retained and must be destroyed when the process is over. In the event one of the employees at the workplace contracts the disease, it would be more beneficial to anonymize the person by not disclosing their name and surname in order to prevent problems such as the infected person being excluded and treated differently from all other employees. However, since other employees also need to be made aware of this risk, this information should be shared in anonymized form and measures should continue accordingly.In conclusion; it appears that measures against the pandemic affecting the entire world will continue in the coming period in business life, as in many other areas. During this process, while necessary precautions are being taken by employers, obligations arising from the KVKK should also not be disregarded, and it should not be assumed that limits can be exceeded under the pretext of public interest.For the Legal Dimensions, Legislation, and Latest Developments Regarding the Coronavirus Pandemic, click here. Attorney Gulsah YAZMACI
