How To Process The Biometric Signature Data: An Approach By The Turkish Personal Data Protection Authority

It was inquired of The Turkish Personal Data Protection Authority ("Authority") whether processing of biometric signature data can benefit from the exception in Article 6/3 of the Turkish Data Protection Law no. 6698 ("DP Law"), in the face of the fact that the respective articles of 14 and 15 of Turkish Code Obligations ("TCO") require that the contracts with written form requirement be signed by hand. This exception states that personal data, save for the data on health and sexual life, can be processed without explicit consent if it is required by the laws.

In their decision dated August 27, 2020, the Authority firstly assessed what is defined as biometric data. Accordingly, biometric data is a type of data that remain unchanged or unforgotten for a lifetime because the data subjects carry these data with themselves. The biometric data are separated into two specific groups: physiological biometric data and behavioural biometric data. While the former includes