- At the entrance of the enterprise, a private password is taken from the people alongside their hand geometry with the help of a device called “Hand Geometry Terminal,” and that this is a different system from fingerprint and palm scanning,
- While the fingerprint and palmprint are unique for each person, hand geometry only includes data such as the length of the fingers and the distance between the joints, therefore it is personal data rather than special categories of personal data since it cannot be used to identify someone on its own,
Collection of such data was necessary to prevent abuse of the subscription.
- Firstly, drew attention to the fact that it is stated in Article 6 titled “Conditions for Processing Special Categories of Personal Data” of the Law, that “biometric and genetic” data are determined as special categories personal data, and that it is prohibited to process special categories of personal data without the explicit consent of the data subject.
Stated that the name of the said device is “… Biometric Hand Terminal,” and that the indispensable feature of hand geometry reading technology, which is a biometric system, is to obtain accurate results, and the margin of error in this device is 1/101.559.956.668.416.
The Board also stated that in the decision no. 2014/4562 of the 15th Chamber of the Council of State, it was stated that biometric systems include methods like fingerprint recognition, palm scanning, hand geometry recognition, and iris recognition;
In the Decision of the Constitutional Court dated 10.03.2022 with the application number 2018/11988, it is stated that biometric data is accepted as “special categories of personal data due to its importance because it contains biological or behavioral information on the data subject which enables a person to be distinguished from other persons and to identify the identity of the person;”
- There is no lawful basis for processing s special categories of personal data to ensure control at the entrances to the service building of the Data Controller, or for the use of biometric data-based systems in this context.
The Board decided to impose an administrative fine of TRY 100,000 on the Data Controller pursuant to subparagraph (b) of paragraph (1) of Article 18 of the Law, considering the fact that the personal data subject to the complaint is special categories of personal data, and that subscribers other than the complainant are also affected by the processing of special categories of personal data in violation of the Law.
You may reach the full Turkish text of the Decision via the link below.