The Personal Data Protection Authority has taken important policy decisions regarding the supervision of corporate e-mail accounts allocated by workplaces to their employees and communication channels used for business.
The Personal Data Protection Authority (KVKK) has published a principle decision regarding the auditing of corporate e-mail accounts allocated by employers to employees and communication channels used for work.
In the decision published in the Official Gazette, it was stated that the corporate e-mail account allocated to employees is a data source containing the employee's professional and sometimes personal relationship network, work pattern and correspondence contents.
It was pointed out that auditing these accounts by the employer is a personal data processing activity that requires observing the balance between the employer's right to management and the employee's right to request the protection of personal data guaranteed in the Constitution and freedom of communication.
In the decision, "Even the employer's processing of traffic/log records without accessing the content of the employee's e-mail constitutes a personal data processing activity in itself. The mere fact that the communication tools belong to the employer or are present at the workplace does not grant the employer unlimited and absolute control authority." statements were included.
In the institution's principle decision, it was noted that when determining the scope of the audit activity, the distinction between "business use" and "private purpose use" should be taken into account according to the purpose of use of workplace communication tools.
In the decision, it was stated that the employer can determine the rules regarding the private use of workplace communication tools, but these rules should be clear, understandable and knowable by the employee. It was emphasized that if the use of private purposes is prohibited, limited or subject to certain time, scope and method conditions, this should be clearly announced to the employee.
In the decision, it was stated that the fact that the employer has technical authority over a particular device, session, network or corporate system does not mean that the employee can freely access the correspondence contents in the employee's personal e-mail account, personal instant messaging application, social media message box or similar private communication areas.
In the decision, it was emphasized that the employee should be informed about the audit activity in advance, and it was stated that the clarification to be made by the employer should go beyond an abstract and general expression and include the legal reason, purpose, scope of the personal data processing activity, whether the audit will be carried out by examining traffic / log records or content audit, under what circumstances the content can be accessed, and the storage period of the data in a clear, understandable and concrete manner.
In the decision, it was emphasized that the audit should be carried out in accordance with the law and the rules of honesty, based on a specific, clear and legitimate purpose, in connection with this purpose, in a limited and measured manner, and the data obtained should be kept only for the period required by the purpose.
In the decision, which stated that graduality in the control was essential, it was stated that access to the content could only be brought to the agenda in exceptional cases where traffic data control was insufficient and access to the content was mandatory.
