The complaint letter submitted to the Authority states the following, in summary: Palm print and fingerprint of the data subject were scanned by the company during the registration to an enterprise in order to grant access to the service area and the scanned data has been processed in the company records; data subjects can enter the building by placing their hands on the device and entering a password, therefore, palm prints and fingerprints of data subjects are scanned without a legally valid explicit consent; the data subject made a request to the data controller company about the issue in line with the Personal Data Protection Law No 6698 (Law) after the termination of the contract; the data controller responded to this request, however, the data subject found the response insufficient. Therefore, the data subject requests the necessary action to be taken regarding the matter. 
Within the framework of the examination initiated on the subject, the data controller was asked for defence against the claims in question. The data controller, in its response letter, states the following, in summary:

• The data subject’s complaint is primarily based on the claim that members can enter the area by having their fingerprints and palm prints scanned with a device, 
• At the entrance, a device called “… Hand Geometry Terminal” is used to verify the registered members, and this device records “hand geometry” of the persons, which is a different process from obtaining fingerprint or palm print,
• At this point, the data controller considers it helpful to explain the concept of “hand geometry”, further adding that fingerprints and palm prints are unique to the individual, in other words, they are biometric data that no other person has with exact features, 
• Yet, hand geometry focuses on the points such as length of fingers, distance between the joints, shape of hand, and it measures the geometric structure of the hand, proportions of the fingers and bones in three-dimensional environment according to a formula. Besides, only the upper part of the hand placed on the device is scanned, so there is no mechanism in the device to scan the palmar side of the hand where fingerprints or palm prints are located, in other words, measuring hand geometry resembles like measuring the height of a person, 
• The fundamental difference between hand geometry and finger or palm print is that while finger or palm print is personal, hand geometry does not have such a personal feature, for example, person X cannot have the same fingerprints with person Y but person X may have the same fingerprints with person Y; so when this situation is evaluated within the scope of the Law No 6698, finger or palm print falls under the special categories of personal data (sensitive data) as it is unique to the person, while hand geometry is considered only as personal data since two different people may have the same hand geometry, in other words, hand geometry is a personal data such as the person's age, name, surname, contact number,
• When it comes to how the device operates; it is not sufficient to obtain only the hand geometry of the members, which means members need to set a password to the relevant device, then the same device measures the hand geometry. After this stage, the members must enter the password every time they use the device and get their hands scanned, in other words, taking the hand geometry of the person is not a sufficient to verify the person correctly because, as stated above, the hand geometry of the person may match with another person, besides setting a password by the data subject prevents the abuse of the device. In cases where the hand geometry is in the same nature with palm and finger prints, it will be sufficient to scan the hand without any further verification method such as setting a password, however, this is scientifically not possible, and since hand geometry is not unique to the individual, other verification methods such as passwords is needed, 
• Considering all the points above; hand geometry data is not categorized as sensitive personal data but personal data, for these reasons, the claim that the company obtains fingerprints or palm prints from its members is completely untrue; again, the claim that the company gives password to the members is not true either, because the members can create their own passwords and access the building by entering this password and the hand geometry into the device,
• Within this scope, the purpose of obtaining hand geometry and entering password into the device is to prevent people other than the members from accessing the building and to prevent the abuse of the membership, and the company did not violate neither provisions of the Law No 6698 nor the Board Resolutions while taking the measures; data of the data subject is processed within the scope of Article 5(2)(c) of the Law; in addition, hand geometry data of the data subject was erased immediately after the membership of the data subject is terminated.

As a result of the examination initiated on the subject, in its Decision dated 7.7.2022 and numbered 2022/662, the Board evaluates that;

• Article 5 of the Law No 6698 titled “Conditions for processing personal data” stipulates that;
  (1)    Personal data shall not be processed without explicit consent of the data subject.
  (2) Personal data may be processed without seeking the explicit consent of the data subject only in cases where one of the following conditions is met:
  a) It is expressly provided for by the laws.
  b) It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.
  c) Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
  ç) It is necessary for compliance with a legal obligation to which the data controller is subject.
  d) Personal data have been made public by the data subject himself/herself.
  e) Data processing is necessary for the establishment, exercise or protection of any right.
  f) Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.
• Article 6 of the Law No 6698 titled “Conditions for processing of Special categories of personal data” describes the sensitive data as “Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data”, further adding that it is prohibited to process sensitive data without explicit consent of the data subject, and paragraph (3) of the same Article rules that “personal data, except for data concerning health and sexual life, listed in the first paragraph may be processed without seeking explicit consent of the data subject, in the cases provided for by laws. Personal data concerning health and sexual life may only be processed, without seeking explicit consent of the data subject, by the persons subject to secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.” Therefore, processing of personal data by the data controller in accordance with the Law is only possible if the processing conditions set forth in Articles 5 and 6 of the Law exist,
• First of all, it is necessary to determine the nature of the personal data subject to the complaint and whether it is sensitive data. The data controller asserts in its response letter that: the device records the “hand geometry” of the data subjects not the palm prints or fingerprints, in this respect the data recorded by the device is “hand geometry" information that does not have biometric nature, and it is also stated that since another person may have the same data, this information is in the nature of personal data such as the person's age, name, surname, contact number, 
• In this context, it is necessary to determine which information belonging to data subjects is processed by the device called “…Hand Geometry Terminal” and the nature of the information paired with the person,
• Following the search made regarding the device on open sources: It is seen that name of the device is “… Biometric Hand Terminal” and the basic principle of operation behind the use of hand geometry scanning technology, as its name suggests, is to measure physical geometric characteristics of an individual’s hand in a three-dimensional environment; in this system, the hand is scanned from 31,000 points in three dimensions then characteristics of the hand and fingers are analyzed; during scanning, the attention is on the length of the fingers, the distances between the junction points, and the geometry of the joints of the fingers. It has also seen that the geometric structure of the hand, the dimensions of the fingers and bones can be measured according to a formula in a three-dimensional environment; in addition, it was emphasized in the explanations that the indispensable feature of biometric systems is to get accurate results, and that there is a 9-character code for each hand in hand geometry; each of these 9 characters contains a total of 36 possibilities consisting of 10 numbers and 26 letters, that is, the probability of the system being wrong is 1/36x36x36x36x36x36x36x36x36x36 = 1/101.559.956.668416. As for the verification process; although the data controller stated that a secondary verification is used with a password due to the possibility of matching the information with another person, in the explanations about the device, the explanations about the device state that the device retrieves the image of the users when they enter their code and verification happens in less than 1 second as soon as users put their hands under the device,
• Verification is a procedure that validates a person has a specified identity and/or that proves the person is authorized to perform certain actions, such as entering a security area or entering a service, as is the subject of complaint letter; identity verification is ensured by asking for information, such as passwords, that can only be known by a specific or authorized person or it can be ensured with biometric data such as face recognition, fingerprint, depending on the characteristics of the concrete incident, 
• In the Decision No. 2014/4562 of the 15th Chamber of the Council of State; It is stated that biometric methods indicate the identity verification techniques that can be automatically verified and performed through measurable physiological and individual characteristics, and these methods include fingerprint recognition, palm scanning, hand geometry recognition, iris recognition, face recognition, retina recognition, DNA recognition,
• Article 4 of the European General Data Protection Regulation (GDPR) describes biometric data as; “personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data”. Also, Article 51 in the Recital Section states that these data are considered biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person, these data will be considered within the scope of the definition of biometric data, therefore, the criterion to consider data as biometric data is that such data must identify or verify only that specific person, 
• In the judgment of the European Court of Human Rights (ECHR) dated 4 December 2008 S. and Marper v. the United Kingdom; Fingerprints, biological samples and genetic profiles are considered as personal data, the court stated that domestic law should be regulated to afford appropriate safeguards to prevent the use of personal data from being inconsistent with the guarantees in Article 8 of the Convention, emphasizes that the need for such safeguards is all the greater where the protection of personal data undergoing automatic processing is concerned,
• Furthermore, the Decision of the Constitutional Court dated 10/03/2022 with application number 2018/11988 on ‘the violation of the right to respect for private life due to the fingerprint registration and attendance tracking system’ provides that; Article 6 of the Law No. 6698 stipulates that the processing of sensitive data is subject to more stringent conditions than general data. Pursuant to the Decision, biometric data is considered as “sensitive data that allows a person distinguished from other persons and identification of the person for containing biological or behavioral information relating to the person”; in case methods that include the processing and sharing of personal data are used in the workplace, constitutional guarantee that will protect the rights and freedoms of the employee should be provided by the administration,
• In the incident subject to the complaint; it is seen that hand geometry data of the data subjects and other members is processed during their entrance to the building; the limits and types of biometric data is not specified in data protection regulations, so that considering that biometrics means "measurement of a living organism", it is understood that even non-physiological behavioral information is included in the definition of biometric data, and therefore it is seen that data controller processes hand geometry data, due to its measurable physiological feature, through a verification technique that can be automatically validated. Although the data controller states that the hand geometry data of a person may be same as that of another person, it is an identification verification system that is performed by means of physiological feature, considering that it is mathematically clear that the hand and fingers are analyzed by scanning the hand in three dimensions from 31,000 points via the device, and the error rate to pair it with the data subject is very low. As a result, it has been concluded that the data controller uses a biometric verification method processes sensitive personal data by obtaining the hand geometry of the members and the data subject,
• In this respect, as per Article 6 of the Law No.6698, the processing of sensitive requires more stringent conditions than the general personal data; and pursuant to Article 6 of the Law, the processing of biometric data, which is sensitive personal data, is possible only if explicit consent of the data subject exists or in the cases where it is expressly stipulated in the laws. In this sense, to apply the method of entering the service building by recording biometric data is possible if the data subject gives explicit consent, if the method is not provided for by the laws, in this context, when the case is examined within the scope of the Law, no legal provision has been found,
• On the other hand, in this concrete case, there is no dispute about the fact that the data subject did not consent to the processing of sensitive personal data for the recording of hand geometry data by the data controller for its use at the entrances to the service building, and as a matter of fact, it is understood from the complaint letter that the data subject has not been adequately informed beforehand about the scope, purpose, limits and consequences of processing activity, which is necessary to mention the existence of explicit consent,
• In the light of these findings, it is concluded that there is no legal basis for the processing of sensitive personal data and the use of biometric data-based systems for the purpose of controlling the entrances to the service buildings of the data controller, and within this framework, the sensitive personal data of the data subject has been processed without a processing condition stipulated in the Law No 6698,
• As is known, Article 12(1) of the Law, titled “Obligations concerning data security” stipulates that;
  “The data controller is obliged to take all necessary technical and organizational measures to provide an appropriate level of security for the purposes of:
  a) preventing unlawful processing of personal data,
  b) preventing unlawful access to personal data,
  c) ensuring protection of personal data,"
• Article 7 of the Law, titled “Erasure, destruction or anonymization of personal data” provides that “despite being processed in compliance with the provisions of this Law and other relevant laws, personal data shall be erased, destructed or anonymized by the data controller, ex officio or on the request of the data subject, in the event that the reasons for the processing no longer exist.” Furthermore, Article 11 regulating data subjects’ rights rules that “Each person has the right to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7”,
• Article 15(5) of the Law rules that “As a result of the examination made upon complaint or ex officio, in cases where it is understood that an infringement exists, the Board shall decide that the identified infringements shall be remedied by the relevant data controller and notify this decision to the relevant parties. This decision shall be implemented without delay and within thirty days at the latest after the notification”,
• Article 15(7) of the Law further adds that “The Board may decide to stop the processing of personal data or transfer of personal data abroad in the case damages which are difficult or impossible to compensate for, and in the event of explicit infringement of the Law”

On the basis of the foregoing evaluations, the Board, with its Decision in its Decision dated 7.7.2022 and numbered 2022/662, decides: 

• to impose an administrative fine of 100.00 TL on the data controller pursuant to Article 18(1)(b) of the Law for the failure to comply with the obligations specified in Article 12(1) of the Law and processing sensitive personal data, biometric “hand geometry” information, without relying on the processing conditions laid down in Article 6 of the Law, taking also into account the following points: unfair content of the offense and the fault, and the financial situation of the data controller; that the personal data subject to the complaint is a sensitive personal data; sensitive personal data of other members are also processed in violation of the Law, affecting a large number of people and that it interferes with right to protect personal data,
• In the response letter of the data controller for the data subject’s request for erasure of his/her personal data, data controller notes that hand geometry data of the data subject was immediately erased upon the termination of the membership contract, however, since the hand geometry information is recorded on the device and erased from the device itself, the controller states it is not possible to send a physical document regarding the erasure activity. Taking into account this statement of the data controller, the data subject shall be communicated to inform of erasure of his/her personal data,
• The processing of sensitive data shall be ceased in accordance with Article 15(7) of the Law, and the data controller shall immediately destruct “hand geometry” data that has been processed and stored to this in accordance with Article 7 of the Law and By-Law on Erasure, Destruction and Anonymisation of Personal Data. In case sensitive data in question has been transferred to third parties, the data controller shall immediately notify those third parties of the destruction obligation. Furthermore, the data controller shall inform the Board of the results of all these transactions.