The Board’s decision dated 24.02.2022 and numbered 2022/172 on requesting sensitive personal data from employee candidates during the recruitment process by the contact office of the data controller residing abroad in Turkey
The following issues were briefly mentioned in the complaint petition which is the subject of the Board’s decision:
- While the data subject was being accepted to the job, the contact office which is the data controller requested criminal record, health report, chest x-ray report, blood group document, photocopy of driver’s license, photocopy of marriage certificate and identity card of family members, and these documents were submitted by the data subject;
- The contact office did not obtain explicit consent from the data subject for the processing of the aforementioned sensitive personal data;
- Due to the fact that the data controller is resident abroad, the personal data of the data subject may also be transferred abroad.
In this regard, it was requested by the Board to take necessary action.
In the letter sent by the data controller to the Board upon the complaint of the data subject, the following issues were addressed:
- The complainant is the contact office of the data controller originating abroad, and it does not have an individual legal personality and commercial activity in accordance with the legal principles;
- Working of the data subject within the body of the data controller is determined directly in accordance with the provisions of the foreign-based
legal legislation, and accordingly, the workplace registry file has been created in accordance with the provisions of the current legislation abroad;
- Since the personal data subjected to the complaint of the data subject is the employee of the data controller residing abroad, the consent of the data subject was obtained within the scope of the workplace personnel file. In this regard, there is no transferring the personal data to abroad without permission in this case.
As a result of the investigation carried out on the subject, the Board has stated that the notification made by the data subject to the contact office is legally valid, since the title of data controller belongs not to the contact office, but to the foreign-based company itself, and because the contact office manager is also representative of the employer of the data controller. However, the Board has determined that it is not unlawful to transfer data abroad in the concrete case subjected to the complaint and the personal data of the data subject is obtained through the contract concluded by the data controller residing abroad within the scope of the business relationship, in accordance with the law of the country of residence, but sufficient explanations are not made to the data subject. The Board has stated that it is necessary to process the personal data of the data subject abroad for the performance of the employment contract, and for this, the explicit consent obtained from the data subject is lawful. Therefore, the Board has decided not to impose any administrative fines on the data controller, but to instruct the data controller only to pay attention and care to the applications of the data subject.
You may access the Decision by this link.
To see our other articles, you may follow the NSN Bulletin via the link.
Authors: Bilge Derinbay, Hande Ülker Pehlivan, Bengisu Çakırca
Contact: bilge.derinbay@nsn-law.com