EMPLOYERS’ MONITORING OF EMPLOYEES USING TECHNICAL DEVICES AND ELECTRONIC SURVEILLANCE
In light of modern technology and, in particular, recent developments, the increasing prevalence of remote and hybrid working models in the business world has brought to the fore the issue of employers monitoring their employees electronically for a variety of reasons, including, but not limited to, performance monitoring, occupational health and safety. This monitoring is carried out using techniques such as the tracking of email correspondence, applications installed on work computers or mobile phones, fingerprint and facial/eye recognition systems, and GPS systems in vehicles or applications.
This article examines the legal mechanisms, basis and limits governing the electronic monitoring of employees in the workplace. Against the backdrop of expanding managerial authority and increasingly sophisticated surveillance technologies, it analyses the balance that must be struck between the employer’s legitimate interest in monitoring and the employee’s fundamental rights to privacy and freedom of work under Turkish law.
- THE MONITORING OF EMPLOYEES IN AN ELECTRONIC ENVIRONMENT FROM THE PERSPECTIVE OF LABOUR LAW
- Specification at the Time of Concluding the Employment Contract
Firstly, it should be noted that the employer’s request and authority to monitor employees are not explicitly regulated in the Labour Code No. 4857[1] . However, this authority is assessed within the scope of the employer’s management rights, as shaped in practice and particularly by Supreme Court rulings. From the employee’s perspective, Article 396 of the Turkish Code of Obligations No. 6098 (“TBK”) governs the “employee’s duty of care and loyalty”, whilst Article 399 governs the “employer’s authority to establish general regulations and issue instructions”. Furthermore, pursuant to Article 4 of the Occupational Health and Safety Act No. 6331, the employer is obliged to ensure the health and safety of employees.
Based on these provisions, it can be said that there is a legal basis for an employer wishing to ensure that an employee performs their duties with due care. However, according to the Turkish Supreme Court, the fact that electronic monitoring will be carried out must be explicitly stated in the employment contract and the employee must be informed of this[2] . Consequently, the employer’s ability to carry out electronic monitoring on the basis of legitimate interests, such as performance, occupational health or safety, is contingent upon this matter being explicitly stated in the employment contract and the employee having been clearly informed[3] .
In practice, there are also views that argue that, even if not specified in the employment contract, such provisions should at least be displayed in a manner visible to everyone in the workplace[4] . However, as the employer must prove that they have obtained the employee’s explicit and informed consent in the event of any disputes arising in practice, incorporating these provisions into the employment contract is a far more reliable and sound approach.
- The Limits and Scope of Electronic Monitoring
The fact that the employer has specified in the employment contract that an electronic monitoring system will be implemented and has clearly informed the employee of this does not grant the employer an absolute and unlimited right to monitor.[5] In particular, this issue requires more detailed examination in terms of the scope of ‘respect for private life’ – a constitutional right – as well as the protection and processing of personal data. At first glance, particularly in situations where equipment such as computers and telephones is provided by the employer, it might be thought that an unlimited right to monitor could be granted on the grounds that the employer has provided this equipment[6]; however, it must be borne in mind that this may vary depending on the specific circumstances of each case. Furthermore, in situations where the employer wishes to terminate the employment contract for just cause using electronic surveillance, the assumption that the employer can access all of the employee’s data—even for reasons such as trade secrets—and consequently terminate the contract for just cause may lead to a misconception.[7] These limitations are particularly consistent with the approach followed in restricting fundamental constitutional rights and freedoms. Thus, the employer’s request for electronic surveillance must be balanced in such a way as to remain within the limits of the workplace and the job; such surveillance must be proportionate and carried out using appropriate means in accordance with the principle of good faith.
Most practical cases involving the breach of these limits before the Turkish Supreme Court concern claims by employers that they terminated the employment contract for ‘just cause’ on the basis of data obtained through electronic surveillance. The Turkish Supreme Court has not formulated a single comprehensive test for assessing the lawfulness of electronic monitoring as such; its approach has instead been to examine, in each case, whether the specific conduct giving rise to termination was established through monitoring that met the requirements of prior disclosure, proportionality and good faith. Where those requirements are not satisfied, the Court has consistently held that evidence obtained through such monitoring cannot support a finding of just cause. Beyond the immediate termination dispute, unlawful or disproportionate monitoring may also expose the employer to claims by the employee in respect of violations of personal rights under the Turkish Civil Code.
- Electronic Surveillance by the Employer Without Consent
Where an employer acts contrary to the matters outlined above—by failing to specify this matter in the employment contract, failing to inform the employee of this matter, and carrying out electronic surveillance using spyware or similar systems without obtaining any consent, or, even where consent has been obtained, conducting electronic surveillance that exceeds the permissible limits—the employee is also entitled to certain rights. In particular, under private law, where the boundaries of the employment contract are exceeded, there are legal remedies available, including provisions under Articles 135–140 of the Turkish Penal Code concerning ‘Offences Against Private Life and the Private Sphere’, and provisions under Articles 24–25 of the Turkish Civil Code regarding violations of personal rights.
For this reason, bearing in mind that criminal and civil proceedings may be brought against the employer in the event of electronic surveillance that is unlawful or, whilst lawful, exceeds the permitted limits, it would be particularly beneficial—in terms of striking a balance between the employee’s privacy and the employer’s legitimate interests—for the employer to proceed by providing the necessary information and taking appropriate measures, and, in particular, by internally monitoring the appropriateness of these measures throughout the process.
- THE MONITORING OF EMPLOYEES IN AN ELECTRONIC ENVIRONMENT FROM THE PERSPECTIVE OF DATA PROTECTION LAW
- General Assessment
The monitoring of an employee in an electronic environment by the employer must also be assessed within the context of data protection law, as the employer may come into contact with the employee’s personal data during such monitoring.
Article 419 of the Turkish Code of Obligations stipulates that an employer may use an employee’s personal data only to the extent that it relates to the employee’s suitability for the job or is necessary for the performance of the employment contract, whilst provisions of specific legislation remain reserved.
As there are no other statutory provisions governing the processing of an employee’s personal data by the employer, and given that the Turkish Code of Obligations explicitly refers to the provisions of specific legislation, employers must act in accordance with the general provisions of the Personal Data Protection Act No. 6698 (the “Law”) and related secondary legislation when monitoring employees electronically.
Under the Law, ‘personal data’ refers to any information relating to an identified or identifiable natural person, whilst examples of categories of personal data relating to an employee include identity details, contact details, personnel records, financial information, professional information, and visual and audio data.
As is generally accepted in the context of employer-employee relationships, the employer will also act as the data controller in relation to personal data processing activities carried out by the employer for the purpose of monitoring the employee electronically.
In order for an employee to be monitored electronically, the employer must inform the employee of this in their capacity as the data controller, regardless of the legal basis on which the data is being processed. When fulfilling this duty to provide information, the employer must include in the information notice details of their identity as the data controller, the purposes for which personal data is processed, to whom and for what purposes personal data may be transferred, the methods by which personal data is collected, the legal grounds for processing, and the rights of the data subject.
- The Scope of Monitoring Employees in a Digital Environment
Employers utilise various methods of personal data processing to monitor their employees’ performance and work processes. A wide range of tools – from monitoring the content of corporate emails to tracking arrival and departure times, and from security cameras to GPS (Global Positioning System) and staff tracking programmes – are used by employers to ensure both the efficient running of the business and corporate security.
However, in the process of processing personal data, it is of the utmost importance to protect employees’ private lives and to ensure that data processing activities are carried out in accordance with fundamental principles such as proportionality, purpose limitation and legal basis. Below, employers’ data processing activities aimed at monitoring employees electronically, and the legal bases for these activities, will be discussed in detail.
- Monitoring the Content of an Employee’s Email Address
Employers may, from time to time, wish to monitor and inspect the content of corporate email addresses allocated to their employees for purposes such as safeguarding the confidentiality of commercial information and ensuring control over the flow of information.
In this context, whilst the legal basis may vary depending on the nature of the specific case, it could be argued that employers may process employees’ personal data by monitoring, accessing and storing the content of the corporate email addresses allocated to them, relying on the processing conditions under Article 5(2)(e) of the Law—which provides that data processing is necessary for the establishment, exercise or defence of a legal right—and Article 5(2)(f), which provides that data processing is necessary for the legitimate interests of the data controller, provided that this does not infringe upon the fundamental rights and freedoms of the data subject.[8]
Furthermore, whilst employers may rely on the legal ground of ‘legitimate interests’ for any data processing activity, it must not be forgotten that a ‘balancing test’ must be carried out, taking into account both the data controller’s legitimate interests and the data subject’s fundamental rights and freedoms, and that the data controller’s legitimate interests must prevail.[9]
It should also be noted that the employer’s monitoring of the contents of an employee’s email address is only permissible for corporate email accounts allocated to the employee by the employer; monitoring the contents of an employee’s personal email addresses would not be lawful.
- Monitoring an Employee’s Arrival and Departure Times
Employers generally monitor employees’ clock-in and clock-out times for reasons such as ensuring work continuity, monitoring working hours, and safeguarding occupational health and safety and corporate security. To this end, employers frequently utilise methods such as magnetic card swiping, SMS verification, and facial or palm recognition.
When monitoring employees’ arrival and departure times, employers must pay particular attention to the principle of ‘relevance, limitation and proportionality’—one of the general principles of data processing. In this context, the Board has ruled in its decisions that, where alternative methods are available for recording employees’ entry and exit times, the processing of employees’ fingerprint data—which constitutes biometric data—is incompatible with the principle of proportionality.[10]
For this reason, it is recommended that the monitoring of employees’ entry and exit from the workplace be carried out using alternative methods, such as a magnetic card system, RFID tags, or the entry into the system of an SMS sent to a mobile phone. For monitoring carried out through these methods, the processing conditions set out in Article 5(2)(c) of the Law—which provides that the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of the contract—and Article 5(2)(d), which provides that it is necessary for the data controller to fulfil its legal obligations, may serve as the applicable legal basis.
However, whilst an employee’s entry and exit from work may be monitored on the basis of the aforementioned methods, where entry and exit are facilitated through biometric data processing methods such as facial or palm scanning, even if the employee’s explicit consent is obtained, this explicit consent will not render the relevant process lawful due to the disproportionate nature of the data processing activity in question.
- Monitoring Employees via CCTV
In practice, many employers use security cameras to ensure the security of physical premises.
Pursuant to the Board’s decisions, it has been established that personal data processing activities carried out by employers via cameras within the framework of occupational health and safety may be conducted on the legal ground set out in Article 5(2)(d) of the Law, namely that data processing is necessary for the data controller to fulfil its legal obligations.[11]
The principle of proportionality must also be observed in personal data processing activities carried out whilst monitoring employees via security cameras. In particular, the use of cameras in areas where employees have a reasonable expectation of privacy, such as changing rooms or toilets, will not be lawful.[12]
Another point employers must bear in mind is that security cameras will process the personal data not only of employees but also of many other individuals who come within the cameras’ field of view. Therefore, in areas monitored by cameras, the obligation to provide information must be fulfilled for all individuals whose data will be processed by displaying appropriate notices (using methods such as QR codes).
- Tracking Employees via GPS
The real-time locations of field staff, couriers/delivery workers, service/maintenance teams and similar employees may be monitored by employers via GPS for a variety of reasons.
Although the European Court of Human Rights ruled in 2022 that an employer’s tracking of an employee’s real-time location via GPS did not constitute a violation of rights [13]under the European Convention on Human Rights in the specific circumstances before it, this ruling was issued in the context of Portuguese law and cannot be transposed directly to the Turkish legal framework. The lawfulness of GPS tracking under Turkish law must therefore be assessed independently by reference to the Law and the principles developed by the Personal Data Protection Board.
Where an employer tracks the GPS of a vehicle used by an employee for the purpose of monitoring the performance of drivers and vehicles, it could be argued that such performance monitoring could be carried out without the need for such an intensive intrusion into the employee’s private life. Consequently, the employer’s personal data processing activity in this regard can only be brought into compliance with the law by obtaining the employee’s explicit consent.
Even if the employee gives explicit consent to the employer processing their real-time location personal data via GPS tracking, the employer must carry out the relevant data processing activity in accordance with the principle of proportionality; the employee should only be tracked via GPS during working hours.
- Monitoring Employees via Staff Tracking Software
Employers use a wide range of staff monitoring programmes to monitor employees electronically; these applications offer numerous features, ranging from recording employees’ computer screens to monitoring social media posts, and from tracking idle time to identifying the websites and applications used.
The extent to which access is granted to employees’ personal data as a result of the monitoring features offered by such programmes is significant in terms of the legal basis for the processing of personal data.
Generally, in accordance with the principle of proportionality that must be observed in data processing procedures, recording employees’ screens or monitoring their social media posts for the purpose of monitoring them would not constitute a proportionate activity, as employees could be monitored by other means and such methods might involve access to a significant amount of data beyond the purpose of the data processing. It could be argued that obtaining the employee’s explicit consent would not render such a data processing activity lawful where it is not proportionate.
Furthermore, if the content of the applications accessed by the employee is not monitored, but only the specific applications on which they spend time are identified, and their activity during working hours is measured through methods such as tracking mouse movements, it could be argued that the employee may be monitored electronically, provided that their explicit consent is obtained for the processing of their personal data in this context.
When obtaining the employee’s explicit consent, it must be borne in mind that such consent must be based on proper prior information provided in accordance with the relevant procedures, must relate to a specific matter, and must be based on the employee’s free will.
- CONCLUSION
Rapid developments in information technology today have significantly expanded the scope within which employers may exercise their managerial authority. This situation has paved the way for employers to develop new methods for monitoring employees’ activities during working hours, thereby leading to more intensive access by employers to employees’ personal data. When assessing the legality of monitoring applications currently in use, consideration must first be given to the limits of the employer’s managerial authority and the extent to which monitoring activities interfere with the employee’s private life; subsequently, the employee must be informed about the monitoring activities and, where necessary, their explicit consent must be obtained.
[1] For explicit provisions on this matter, see: ILO, Protection of Workers’ Personal Data, Article 6.14
[2] For decisions rendering the termination of an employment contract ‘unjust’ due to electronic surveillance without the worker’s knowledge or consent, see: Supreme Court of Appeals 22. H.D. Case No. 2017/21857, Decision No. 2019/9884, dated 7 May 2019; Constitutional Court, Individual Application Decision No. 2016/13010, dated 17 September 2020
[3] Nurata, Zeynep Ceren, ‘Electronic Surveillance in the Workplace as a Legal, Organisational and Ethical Issue’, Gazi Journal of Economics and Business, 2021, 7(3), pp. 214–225 (Last accessed: 24 September 2025 https://dergipark.org.tr/en/download/article-file/1671164
[4] Derdiman, 2010, pp. 58–59
[5] ILO, Protection of Workers’ Personal Data, Art. 6.14
[6] For the ruling regarding the employer’s right to monitor equipment provided by the employer and, consequently, to terminate the employment contract on just cause, see: Supreme Court of Appeals, 9th Civil Chamber, Case No. 2009/447, Decision No. 2010/37516, dated 13 December 2010
[7] Supreme Court of Appeals, 9th Civil Chamber, Case No. 2018/10718, Decision No. 2019/559, dated 7 May 2019
[8] Decision No. 2023/86 of the Personal Data Protection Board dated 19 January 2023
[9] Conditions for the Processing of Personal Data. (2025). KVKK Publications (No. 100). Ankara: Personal Data Protection Authority. p. 19
[10] Decision No. 2020/404 of the Personal Data Protection Board dated 20 May 2020
[11] Decision No. 2022/797 of the Personal Data Protection Board dated 4 August 2022
[12] European Commission, Electronic Monitoring and Surveillance in the Workplace, p. 27.
[13] European Court of Human Rights. (13 December 2022). Florindo de Almeida Vasconcelos Gramaxo v. Portugal (Application No. 26968/16). HUDOC.