he protection of personal data remains relevant and important, and one of the most significant obligations in this regard is the employer’s obligation to protect personal data. Additionally, under Article 75 of the Labor Law, employers are obligated to keep and not disclose the information they acquire about employees.
As known, one of the most important obligations introduced by the Personal Data Protection Law is the requirement for data controllers to obtain explicit consent before processing personal data. One of the exceptions to this obligation is the processing of personal data of the parties to a contract when the processing is directly related to the establishment or performance of that contract.
This exception can be used for employment contracts and only for the necessary information required for the establishment of the contract. However, it should be noted that until the employment contract is signed, many discussions and requests for information are made to the employee. Sometimes, these questions may even infringe upon the privacy of the individual. At this point, the Personal Data Protection Law emphasizes that only data that is relevant to the purpose of use and with the explicit consent of the employee can be processed. Therefore, it is recommended that all employers obtain explicit consent from employees before collecting data during job interviews and refrain from processing data that exceeds the purpose of use, violates the principle of equality, or infringes upon the privacy of the individual.
Employers who process data obtained with explicit consent from employees only for the purpose of use have an obligation to keep this data confidential and not share it with anyone. This obligation is more stringent for employers based abroad or working in partnership with foreign entities, but it can be lifted in the event of a workplace inspection. Similarly, employers have the right to share this data to fulfill legal obligations, such as social security procedures.
One controversial issue here is whether employers who collect many resumes during the hiring process can retain the resumes of unsuccessful applicants if they have the explicit consent of the applicants. In my personal opinion, since the law draws a line by allowing the processing of only data relevant to the purpose of use, keeping resumes for future evaluation when an employment relationship is not established may be in violation of the law.
Finally, it should be emphasized that the law imposes penalties, including imprisonment for up to 3 years, on employers who do not protect the personal data of employees. Furthermore, if the data that is not protected pertains to special categories of personal data, such as race, ethnicity, political opinion, philosophical belief, religion, sect, attire, association, foundation, or union membership, health, sexual life, criminal convictions, and security measures, or biometric and genetic data, then the penalties are increased by half.
