New Regulation on Employers' Authority to Audit Corporate Communication Channels
With a new principle decision published by the Personal Data Protection Authority, legal limits have been introduced to employers' authority to audit employees' corporate email and communication tools.
In line with the new principle decision of the Personal Data Protection Authority published in the Official Gazette, employers' authority to audit corporate communication channels has been restricted and employees' right to privacy has been safeguarded.
Principle Decision Published in the Official Gazette
The principle decision determining the procedures and principles regarding the auditing of corporate email and communication channels, prepared by the Personal Data Protection Authority, was announced to the public through the Official Gazette.
Communication Tools and Personal Spaces
It was explicitly stated in the decision that corporate email accounts allocated to employees host both professional activities and, from time to time, personal relationship networks.
Status of Traffic and Log Records
It was emphasized in the decision that even if the employer processes only traffic or log records without directly accessing the content of the employee's email, this constitutes a personal data processing activity.
No Unlimited Audit Authority
It was stated that the fact that the communication tools are owned by the employer does not alone grant an unlimited and absolute audit authority, and that technical competence does not provide the right to freely access contents.
Distinction Based on Purpose of Use
It was regulated that employers must take into account the distinction between business-related use and private use in the utilization of workplace communication tools.
Prior Notification of Employees
It was reported that employees must be informed in advance about audit activities, and that covert surveillance methods and indiscriminate recording tools will be considered unlawful.
Legal Sanctions and Administrative Actions
It was stated that in the event of failure to comply with the specified obligations, administrative actions will be taken against data controllers pursuant to Article 18 of the Personal Data Protection Law No. 6698.