Turkey’s Data Protection Board (“Board”) decided that biometric signature cannot be processed without explicit consent since it does not fall within the scope of provisions regulating signature under Turkish Code of Obligations number 6098 (“TCO”).
The Board, upon an opinion request, made the following assessments:
- The way that people walk, the way that they press the keyboard, the pressure applied while using smart devices and the way they press, the way that they drive constitutes biometric data,
- In cases where there is no express consent, biometric data can only be processed if prescribed by law;
- if biometric data processing is prescribed by law, the provision in question should be clear enough to leave no ground for doubt;
- The biometric signature is obtained by the signatories creating their signatures on a special tablet/pad by using certain biometric data, and this data is usually linked inseparably to the signed document;
- Since biometric signature solutions are not defined within the framework of a specific standard, they have different fictional features and are not considered equivalent to wet-ink signature;
- Biometric signature not being equivalent to the signature affixed by hand considering all of its functions is also mentioned in the “Electronic Identification and Trust Services Regulation” (eIDAS), which is the European Union regulation standard on electronic identification and trust services for transactions in the electronic environment in the European Digital Single Market;
- The provisions regarding a signature in the TCO are the regulations for classical signature and electronic signature;
- The interpretation of these provisions in a way to comprise the biometric signature will lead to a broad interpretation of the exception of “prescribed by the law” and will be against the principle of proportionality.
Considering these assessments, the Board decided that;
- The biometric signature is eligible to be considered as a special category personal data;
- Therefore, it can only be processed in the presence of the express consent of the person or if clearly prescribed by the law;
- The provisions regarding the form of the contracts in the TCO do not fulfill the requirement of being “clearly prescribed in the law”.
Please see this link for the summarized decision dated 27 August 2020 and numbered 2020/649 which was published on the Board’s official website on 26 September 2020 (only available in Turkish).
