Continuing to Process Personal Data of the Employee by the Employer After the Termination of the Employment Contract

The Personal Data Protection Board (“the Board”) evaluated the complaint application about continuing to process the personal data of the data subject by the employer after the termination of the employment contract in its decision dated 20.10.2022 and numbered 2022/1147.

The complaint subject to the decision is the data subject’s personal data was processed unlawfully since the data controller company continues to use the photos of the data subject taken from a live broadcast, for promotional purposes, on the social media accounts of the company and the press after the termination of the employment contract, and in addition to this, the data controller company continue to use the phone number of the data subject in relations with the courier companies after the termination of the employment contract.

The Board made the following explanations regarding the complaint;

• Although the photos of the data subject are included in the job description of the data subject, and it is appropriate to keep them in the archive of the data controller for legal periods, displaying the photos of the data subject for advertising and marketing purposes is against the ordinary course of life to carry out activities since the employment contract of the data subject has been terminated, and then the data subject has started to work somewhere else.
• Although it is stated by the data controller that the data subject had given his/her mobile phone number to the courier companies willingly and it is seen that the relevant courier companies were not informed of the termination of the employment contract, the processed personal data must be in accordance with the principle of “accuracy and up-to-date when necessary” stipulated in Article 4 of the Law on the Protection of Personal Data No. 6698 (“DPL”). Therefore, the data controller does not pay the necessary attention to the protection of personal data.
• In addition, in the expert report given during the case pending in general courts, it is stated that the data subject is shown as the responsible personnel who carried out the transaction in many sales made after the termination of the employment contract. For this reason, personal data has been processed in violation of the principle of “being accurate and up to date when necessary” in Article 4 of the DPL.
• Since it is seen that personal data is processed in violation of general principles and data processing conditions, necessary technical and administrative measures have not been taken by the data controller to protect personal data.

In this regard, the Board adopted the following decision;

• Processing personal data without valid reason within the scope of the DPL by continuing personal data sharing after the employment contract of the data subject is terminated, and the records in the data controller company and showing the data subject as the responsible personnel even after the termination of the employment contract violates the principle of “being accurate and up-to-date when necessary” in Article 4 of the DPL. Regarding the data controller, who is understood to have failed to fulfill its obligations outlined in Article 12 of the DPL, since it was seen that no other legal reason could be shown by the data controller in the processing of this data, it has been decided to impose an administrative fine of TRY 250,000 (approx. EUR 11.671) on the data controller, taking into account the high risk of negative consequences for the data subject, such as sales and cargo sending, using the identity and contact information of the data subject.
• The data controller has been instructed to destroy the phone number information, which is understood to have been processed unlawfully, from their records and to destroy name and surname information from the digital payment systems of the store, and to send the report that will be duly issued to the data subject’s representative.

Tagged with: Özdağıstanli Ekici Attorney Partnership, Burak Özdağıstanli, Bensu Özdemir, Ebru Gümüş, Data Protection & Privacy