Istanbul school fined 700,000 TL for unlawful facial recognition surveillance of teachers
A private school in Istanbul was fined 700,000 Turkish Lira by the Personal Data Protection Authority for using facial recognition to monitor teachers' work attendance without valid consent. The regulator found the system violated proportionality and purpose limitation principles despite the school's claim that staff had a choice of authentication methods.
What happened
Öncü Derya Eğitim Hizmetleri ve Tic. A.Ş, a private school in Istanbul, deployed a facial recognition system at its entrance from 2021 onwards to monitor entry and exit of all employees, including teachers.
Teachers filed a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) through their lawyers alleging that biometric data was recorded forcibly without genuine consent, despite the school's claim that staff could choose to use cards or facial recognition.
Reported impact
Teachers reported being afraid to refuse the system due to fear of losing their jobs or being fired, and stated they were forced to register their faces and had them systematically recorded and stored daily at work entry and exit.
Index analysis
The Personal Data Protection Authority concluded that although the school sought explicit consent to process biometric data, the consent was not given freely and voluntarily, and that less intrusive methods existed for monitoring attendance.
The regulator found the facial recognition system violated the proportionality principle and the purpose limitation principle when applied to monitoring work attendance.
Governance controls
The Personal Data Protection Authority imposed an administrative fine of 700,000 Turkish Lira on the school for unlawful processing of special category personal data.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.