Monitoring Employee Computers by the Employer

Monitoring Employee Computers by Employers: KVKK (GDPR) and Legal Boundaries

A Digital Surveillance Guide in the Light of KVKK, Labor Law, and Supreme Court Decisions

In the digitalized business world, monitoring employees' company computers, e-mails, and internet usage by the employer is one of the most widely debated legal issues today. On the one hand, there is the employer's right of management and the objective of auditing efficiency, while on the other, there is the employee's right to privacy and their rights under the Personal Data Protection Law (KVKK/GDPR). So, can an employer monitor an employee as they wish in the electronic environment? Where do the legal boundaries begin?

What Does the Employer's Right of Management Cover?

Under the Turkish Code of Obligations (TBK), the employee is obliged to perform the undertaken work with care and to protect the legitimate interests of the employer (duty of loyalty). Within this scope, the employer may issue instructions and conduct audits (right of management) to ensure the execution of work, the protection of company secrets, and a system compliant with the principles of honesty. Therefore, it is considered reasonable for the employer to monitor whether the employee is properly carrying out their duties and to utilize various technical methods to do so.

Company computers, internet connections, and corporate e-mail accounts are tools allocated to the employee by the employer "for the purpose of performing the work." Consequently, the employer has the right to monitor the use of these tools and demand that they be used strictly for business purposes. However, this right to audit is not unlimited and is subject to specific legal regulations.

The Obligation to Inform and Clarify in Computer Monitoring

The most critical requirement an employer must fulfill to legally monitor an employee's computer and electronic communications is prior notification. This matter has been explicitly outlined in the decisions of the European Court of Human Rights (ECHR) and the Constitutional Court (AYM).

If the employee has not been expressly warned in advance that their computer, e-mails, or internet history may be monitored, they possess a reasonable expectation of privacy regarding their communications. This notification must be conducted in a written and provable manner—either via a clear clause added to the employment contract, an internal Information Technology Usage Policy, or a KVKK Clarification Text.

Monitoring Employee Computers within the Scope of KVKK

Any monitoring activity conducted on the employee's computer (such as log records, internet history, and correspondences) is a data processing activity within the scope of the Personal Data Protection Law (KVKK). For this process to be lawful, basic principles must be adhered to:

Lawfulness Criteria

• Legitimate Purpose: Monitoring must be based on a tangible, legitimate objective, such as ensuring information security, preventing data breaches, or measuring workplace productivity.
• Proportionality: The monitoring activity must be proportionate to the intended goal. Practices like taking continuous screenshots or using keyloggers may be deemed disproportionate.
• Limitation: The data obtained should only be evaluated in a manner limited to the purpose of processing and stored only for as long as necessary.

Covert Monitoring (Keyloggers, etc.) and Precedent Supreme Court Decisions

Data obtained via tracking software, keyloggers, or instant screen trackers (screen trackers) installed by the employer on the employee's computer without their knowledge constitutes unlawful evidence.

Decision of the 22nd Civil Chamber of the Supreme Court (E.2017/21857, K.2019/9884):
"Failing to inform the employee that they are being monitored or monitoring them covertly must be accepted as unlawful, even if the data obtained as a result of this monitoring explicitly demonstrates that the employment contract was violated by the employee. It is not possible to put forward the information acquired through covert monitoring as a justified reason for termination."

In summary; even if the employee is neglecting their duties during working hours or leaking corporate data, if the employer discovers this situation through a hidden system established without informing the employee, a termination made using this data could be deemed an unjustified termination, and the payment of severance/notice pay may be required.

Is Personal Internet Use a Reason for Dismissal?

If the employer has prohibited the use of computers and the internet for personal purposes in the workplace from the very beginning and formally notified the employee of this rule, the employee is obliged to comply. According to the decisions of the 9th Civil Chamber of the Supreme Court, prolonged internet use for personal purposes (such as social media, watching videos, etc.) during working hours without the employer's permission may constitute a valid or justified reason for the termination of the employment contract. However, it is mandatory that this detection is made through informed monitoring.

Limits of Employee Monitoring in Remote (Home Office) Work

Under the Remote Work Regulation, the employer has the right to monitor the remote worker. Nevertheless, the methods and tools of this monitoring must be disclosed to the employee in advance. The home environment represents the employee's private sphere. Therefore, demanding that their camera remain on continuously, implementing ambient listening, or enforcing excessive digital surveillance is a clear violation of the principle of proportionality and constitutional rights.

Conclusion and Recommendations

To avoid victimization in legal proceedings, it is imperative for employers to draft a detailed Information Systems Usage Policy and fulfill their KVKK disclosure obligations. Employees, in turn, should be careful not to use the tools provided by the company for personal activities.

Note: This article is intended for general informational purposes and has been prepared in light of current legislation and Supreme Court rulings. [cite: 1]