Employer can restrict the private use of internet and/or social media during working hours over the workplace internet. The employer may limit the internet provided by the workplace to be used for business purposes, as well as block access to social media sites and/or certain sites.
When the privacy legislation and precedent cases are considered, for the inspection on employee e-mails to be legal;
1.the employer must have a legitimate interest in monitoring communication by considering whether such interest can be pursued by only monitoring the flow of the communication or monitoring the content of the communication is compulsory,
Employer’s legitimate interest is essential for the surveillance of employee communication. Legitimate interest is assessed for each individual case by taking into account the characteristics of the workplace and the job the employee performs. In the Constitutional Court’s decision no. 2018/31036, as the purpose of the e-mail surveillance was to ensure the business to run effectively in the workplace which provides financial services with a large number of employees, legitimate interest of the employer was recognized. The same approach was also adopted in Constitutional Court’s decision no. 2016/13010, and although the surveillance was found lawful as the employee was not informed beforehand, the legitimate interest of the employer was recognized in surveillance of employee communication in order to ensure effective conduct of business.In this regard, it would be fair to state that employers have a legitimate interest in monitoring email conversations during internal investigations or inspections to ensure that business is conducted effectively and that laws and regulations as well as company policies are followed. As a personal data processing activity, the employer must base its processing on one of the conditions under Article 5 of the DP Law as well as comply with the principles under Article 4. In case the employer bases its processing on the legal basis of legitimate interest, a balance test should be conducted with the legitimate interest of the employer as data controller and the fundamental rights of the employee as data subject. In order to process data based on this condition, the data controller must have a legitimate interest and the fundamental rights and freedoms of the data subject must not be damaged. In practice, particularly in internal investigation processes, it is common for global companies to have these investigations conducted not by the employer, but by the global entities to which the employer is affiliated. In such cases, the internal investigation process cannot be justified based on the legitimate interest of the employer as a data controller. If an internal investigation is conducted by a third party other than the employer, explicit consent must be obtained from the employees.
2. The inspection needs to be conducted in a transparent manner and the employees must be informed by the employer beforehand about the surveillance, its purposes, its legal grounds, its scope, its results, and employees’ rights. In Decision No. 2018/31036, the Constitutional Court requests that the following information be included in the privacy notices to be served on employees in order for the employer to examine their email correspondences and rely on the conclusions reached in a prospective termination:s under Article 5 of the DP Law as well as comply with the principles under Article 4. In case the employer bases its processing on the legal basis of legitimate interest, a balance test should be conducted with the legitimate interest of the employer as data controller and the fundamental rights of the employee as data subject. In order to process data based on this condition, the data controller must have a legitimate interest and the fundamental rights and freedoms of the data subject must not be damaged.
For a lawful surveillance of employee e-mails, the employees must be informed that their e-mail communication beforehand. Otherwise, employees would have a rightful expectation of privacy Constitutional Court deems the provisions in an employment contract regarding employer’s right to monitor communication as a valid mean of information. Therefore, if the employment contract provides a provision regarding e-mail monitoring, the informing duty is deemed to be fulfilled. However, as surveillance of e-mail communication is a data processing activity, the employees must be informed according to the DP Law before the processing vie a specific privacy notice. Moreover, the Supreme Court holds that even though a confidentiality agreement may stipulate that the employee is prohibited from taking company information and documents outside the workplace, either verbally or in writing, and even if the employee violates this obligation, it is considered unlawful for the employer to monitor the employee using a program installed on the employee’s computer without their knowledge. Consequently, the Supreme Court deems the termination of the employee’s contract, based on evidence obtained in this manner, to be unlawful.
3. the intervention to the privacy of the employee must be convenient to accomplish the target of the surveillance,
4. the intervention must be compulsory for achieving the target by surveillance and the same results must not be able to be accomplished by other means which requires fewer personal data to be processed or require them to be processed less intensely,
The surveillance must be compulsory for the target to be achieved. This requires choosing the methods leading less data to be processed. If the same target can be achieved by less intense data processing, the surveillance would be unlawful, which would also violate the principle of proportionality under the DP Law. In the Constitutional Court’s decision no. 2016/13010, the surveillance was found to be unproportionate as the results could be achieved by less intrusive methods. The decision stated that the employer failed to justify why access to the applicant’s email exchanges was required. The decision made clear that the employer could not justify conducting an email surveillance as essential and necessary in this context because there were other methods available that could have served the same purpose, such as: (i) reviewing the parties’ complaints and defenses, (ii) hearing witnesses, (iii) analyzing workplace records, and (iv) Inspecting the processes and outcomes of projects.
5. the data to be collected must be limited by the purpose of the surveillance, no excessive data processing must take place,
The scope of surveillance must be limited to what is strictly necessary. Excessive data processing would render the surveillance unlawful. In the Constitutional Court’s decision no. 2018/31036, as the employer used only emails that indicating the applicant was engaged in commercial activities in order to support its claim, the surveillance was found to be limited to what is necessary. That said, In the Constitutional Court’s decision no. 2016/13010, it is stipulated that examination of the third party communication as well as the ones between the team members, the inspection was not limited to allegations in question. Thus, the employer did not limit itself to the email traffic data and had a broad breadth of access to the email contents.
6. the legitimate interest of the employer must be balanced with the employee’s fundamental rights and freedom.
In this regard, the Personal Data Protection Board has issued several decisions imposing administrative fines in cases where the employer has monitored employees using tools without fulfilling the obligation to inform. The Board examines such cases within the framework of the six criteria established by the Constitutional Court under this heading. For instance, in its decision dated 25/11/2021 and numbered 2021/1187, the Board found that the data controller company, which was the former employer of the data subject, unlawfully accessed the personal data of the former employee, including email conversations with his fiancé, personal bank account statements, and records of expenditures, without providing proper information. Due to this violation, the Board imposed an administrative fine.
In addition to the above, there may also be instances where the employer, acting as the data controller, needs to monitor the employee’s social media activities. As a data controller, the employer must prevent the employee from sharing personal data processed within the organization on their own social media account. This obligation falls under the data controller’s responsibility to take technical and administrative measures to ensure the protection of personal data. This is also highlighted in the Personal Data Protection Board’s Decision dated 2022 and numbered 2022/630. In this case, the data subject filed a complaint because photographs taken during a rhinoplasty surgery by a doctor employed by the data controller were shared on the doctor’s personal social media account without the data subject’s explicit consent. The Board further noted that the hospital, as the data controller, was aware that the photographs had been shared on the doctor’s social media account, and that the hospital had failed to take the necessary administrative and technical measures to prevent the doctor from sharing these photographs. Consequently, the Board imposed an administrative fine of 100,000 TRY on the hospital.
Such a sharing by the employee, in any case, concerns the disclosure of confidential information and personal rights if it directly targets an employee. In accordance with Article 25/II-b of the Employment Law, the employer can immediately terminate the employment agreement without having to pay severance, whether it is an agreement for definite or an indefinite period, before it expires or without having to comply with the notice periods, if the employee speaks or acts against the honour or reputation of the employer or a member of the employer’s family, or asserts or accuses the employer in matters affecting his honour with groundless accusations. Therefore, use of social media to disparage the employer can be a reason for immediate termination of the employment relation, if the employer duly finds out about such social media post before the employee deletes it.
Also, divulging confidential information is also regarded as a reason for immediate termination. Therefore, using social media for ths purpose would also be result in employment relation.
