The Guideline on Processing Biometric Data Published by The Personal Data Protection Authority

• Biometric Data

• Legal Reason for Processing Biometric Data and Principles of Processing Such Data

1. Data processing activity must not infringe the essence of fundamental rights and freedoms. Since the protection of personal data is one of the fundamental rights and freedoms regulated in the Constitution of the Republic of Turkey, it is clear that biometric data processing activities must also be subject to fundamental guarantees in terms of fundamental rights and freedoms stipulated in the Constitution, and at this point, the principle of proportionality is of paramount importance.
2. The method applied by the data controller for processing data must be appropriate for achieving the purpose of processing, as well as the data processing activity must be appropriate for the purpose that be achieved.
3. The biometric data processing method must be necessary for the purpose to be achieved. In other words, if there is any alternative method other than processing biometric data, the biometric data must not be processed, since it will not be necessary to process the biometric data. This principle has also been underlined by the Decision of the Personal Data Protection Board (in Turkish “Kişisel Verileri Koruma Kurulu”, hereinafter referred to as “the Board”) dated 25/03/2019 and numbered 2019/81 and its Decision dated 31/05/2019 and numbered 2019/165.
4. There must be proportionality between the purpose and means to be achieved by data processing. In terms of biometric data processing, the severity of the intervention and the reasons justifying the intervention must be proportionate; that is, disproportionate interventions must not be made to the data owners as a result of the method used. In case there is more than one method, choosing the most appropriate one among them refers to the proportionality principle.
5. Biometric data must be retained for as long as necessary, and after the necessity ceases, the data must be destroyed immediately and without delay.
6. Limited in line with the purpose of processing; data controllers are required to fulfill their obligation to inform in accordance with the Article 10 of the Code. Considering the importance and sensitivity of biometric data, data controllers who will process biometric data must also clearly inform the data owners about which biometric data is collected for what legal reason and for what purpose, the importance of these data, the consequences that may arise in case of violation (risks of processing of biometric data).
7. If explicit consent is required, the explicit consent of the data owners must be duly obtained in accordance with the Code. In order for an express consent to be valid, the data owner must be conscious of his/her behavior and must be able to make his/her own decision.

1. Biometric data must only be stored in cloud systems by using cryptographic methods.
2. Derived biometric data must be stored in a way that does not allow the recovery of the original biometric feature.
3. Biometric data and its templates must be encrypted in accordance with current technology, with cryptographic methods that will provide adequate security. The encryption and key management policy must be clearly defined.
4. Before installing the system and following any amendments, the data controller must test the system through synthetic data (that is not real) in test environments to be created.
5. The data controller must limit the use of biometric data to the extent that what is necessary for testing purposes. All data must be deleted at the end of the tests at the latest.
6. The data controller must implement measures that warn the system administrator and/or delete and report biometric data in case of unauthorized access to the system.
7. The data controller must use certified equipment, licensed and up-to-date software in the system, prefer primarily open source software and realize the necessary updates in the system on time.
8. The lifetime of devices that process biometric data must be traceable.
9. The data controller must be able to monitor and limit user actions on the software that processes biometric data.
10. Hardware and software tests of the biometric data system must be performed periodically.

1. An alternative system must be provided without any restrictions or additional costs for data owners who do not grant their explicit consent or in the event that the biometric solution is not being used,
2. An action plan must be created in case of failure of authentication by biometric methods,
3. An access mechanism for authorized persons to biometric data systems must be established, managed and those responsible of such mechanisms must be identified and documented,
4. Employees involved in the biometric data processing must receive a special training on the processing of biometric data and such training must also be documented.
5. A formal reporting procedure must be established so that the employees can report possible security vulnerabilities in systems and services and threats that may arise as a result of such vulnerabilities.
6. The data controller must establish an emergency procedure to be implemented in the event of a data breach and must announce it to everyone concerned.