KVKK clarifies biometric data rules for attendance tracking

The Personal Data Protection Authority (KVKK) has issued a clarification regarding the principle decision on processing biometric data for the purpose of monitoring work attendance. This follows inquiries from various data controllers across different sectors.

In response to arguments suggesting that fingerprint or palm scanning might not constitute biometric data, the KVKK emphasized that any data capable of uniquely identifying or verifying a natural person through specific technical methods is classified as biometric data. The authority clarified that converting such data into mathematical codes for database storage does not change its status as biometric data.

The decision specifically addresses biometric data processing for attendance tracking. The KVKK noted that in high-security or critical areas, the processing of such data must remain limited, proportionate, and strictly necessary to mitigate potential security risks and data breaches.