The Personal Data Protection Authority (KVKK) has published a principle decision regarding the auditing of corporate e-mail accounts allocated by employers to employees and communication channels used for work.
OFFICIAL GAZETTE PUBLISHED
KVKK's "Principle Decision Concerning the Procedures and Principles to be Followed in Personal Data Processing Activities Carried Out by Supervising the Communication Channels Used for the Purpose of Conducting Business, Particularly the Corporate E-Mail Accounts Allocated to Employees by Employers" was published in the Official Gazette.
In the decision, it was stated that the corporate e-mail account allocated to the employees is a data source containing the employee's professional and sometimes personal relationship network, work pattern and correspondence contents.
In the decision, it was pointed out that the auditing of these accounts by the employer is a personal data processing activity that requires the balance between the employer's right to management and the employee's right to request the protection of personal data guaranteed in the Constitution and freedom of communication. statements were included.
EMPLOYER CANNOT FREELY ACCESS CORRESPONDENCE CONTENT
In the decision, it was noted that when determining the scope of the inspection activity, the distinction between "business use" and "private purpose use" should be taken into account according to the purpose of use of workplace communication tools.
In the decision, it was stated that the employer can determine rules regarding the private use of workplace communication tools, but these rules must be clear, understandable and known to the employee. It was emphasized that if private use is prohibited, limited or subject to certain time, scope and method conditions, this should be clearly announced to the employee.
In the decision, it was stated that the fact that the employer has technical authority over a particular device, session, network or corporate system does not mean that the employee can freely access the correspondence contents in the employee's personal e-mail account, personal instant messaging application, social media message box or similar private communication areas.
EMPLOYEES SHOULD BE INFORMED IN PRIOR ABOUT THE AUDIT
In the decision, it was emphasized that the employee should be informed about the audit activity in advance, and it was stated that the clarification to be made by the employer should go beyond an abstract and general expression and include the legal reason, purpose, scope of the personal data processing activity, whether the audit will be carried out by examining traffic / log records or content audit, under what circumstances the content can be accessed, and the storage period of the data in a clear, understandable and concrete manner.
In the decision, it was emphasized that the audit should be carried out in accordance with the law and the rules of honesty, based on a specific, clear and legitimate purpose, in connection with this purpose, in a limited and measured manner, and the data obtained should be kept only for the period required by the purpose.
In the decision, which stated that graduality in the control was essential, it was stated that access to the content could only be brought to the agenda in exceptional cases where traffic data control was insufficient and access to the content was mandatory.
ADMINISTRATIVE ACTION WILL BE IMPLEMENTED TO THOSE WHO DO NOT COMPLY WITH THE PRINCIPAL DECISIONS
In the decision, it was underlined that supervision carried out through secret monitoring methods, in which the employee is not informed in advance, and tools that record all the employee's transactions indiscriminately, will be deemed unlawful.
In the principle decision, it was stated that if it is determined that the obligations in question are not complied with, the necessary investigation will be carried out, taking into account the characteristics of the concrete case, and administrative action will be taken against the relevant data controllers in accordance with Article 18 of the Personal Data Protection Law No. 6698.
