Biometric Data for Time Tracking and the Turkish DPA Approach
Summary: Fingerprint and facial recognition can bind a person to a time event, but their sensitive, difficult-to-change nature requires a higher necessity and proportionality assessment.
Key questions
- Is biometrics genuinely necessary?
- Could QR, card, or an authorized app achieve the same purpose with less intrusion?
- Are collection and retention limited?
- Are access, encryption, logging, and supplier controls adequate?
- Were employees clearly informed?
Reading the 2026/921 notice
The Turkish DPA’s notice concerning the April 29, 2026, 2026/921 principle decision reports a public consultation process on biometric data for time tracking. It should not be read alone as a blanket permission or prohibition for every workplace. Purpose, necessity, proportionality, alternatives, and safeguards remain context-specific.
Conclusion
Biometrics is not automatically better because it appears stronger. Compliance requires evidence of necessity, proportionality, alternatives, and technical and administrative safeguards.
Sources
This article is for general information and is not legal advice.