The Institution of Protection of Personal Data, with the decision dated 27.08.2020 and numbered 2020/649, stated that the biometric signature carries biometric data qualities and the procession of data carrying this qualification is possible only under certain circumstances.
In the brief summary of this decision, according to the Turkish Code of Obligations numbered 6098, the provisions stating the contract forms, regulates the signatures must be made own hand and it was discussed if the biometric signature can be examined within the scope of special quality personal data and explicit consent due to the Code numbered 6698. The Institution utilized this data as special quality personal data regarding these datas are within the scope of data that remains unchanged for life without any interference. Datas such as iris, retina, fingerprints, face, palm, veins constitutes physiological natured biometric datas. Individuals already carry these characteristics so it is impossible for them to be changed or forgotten.
However, as it is known, despite the fact that biometric datas are within the scope of special quality personal data, a biometric data can only be processed without explicit consent if it is stipulated in the Law. In accordance to that it should be evaluated that if the processions of biometric datas are stipulated in Law, the provision which is the subject must be so clear leaving no considerations. The content of our Law of Obligations includes both electronic and own hand signatures. The legislative regulated both of these signatures separately, and interpreting the regulation in the Law of Obligations including the biometric signature will cause the broad interpretation of the regulation titled ‘’ Processing of Special Quality Personal Data’’ regulated under the Article 6 of the Code numbered 6698 and also will be contrary to the principle of proportionality.
In this context, as a result of the evaluations made by the Institution, it is stated that the biometric signature has the quality of biometric datas and obtaining the explicit consents of the people concerned, the necessary illumination should be done and the measures to be taken by the data controllers should be taken carefully.