Turkish Personal Data Protection Authority Scrutinises Employers' Monitoring Power Over Employees

June 2022 – On 23 May 2022, the Turkish Personal Data Protection Authority (“Authority”) issued a decision (“Decision”) on the power of employers to access employee corporate e-mail accounts. In the Decision, the Authority examined the complaint of an employee who claimed that their employer monitors their corporate e-mail address as a data controller and ruled that the employer violated the Data Protection Law (“DP Law”) and imposed a monetary fine of TRY 250,000 (approx. EUR 14,215).

Background

During a lawsuit, the employer submitted the contents of e-mails including the personal correspondence of the employee with their fiancée, personal bank account statements and expenditure records of the employee as evidence.