23 June 2022
You may find below our notes on the Summary of Personal Data Protection Board’s (“Board”) Decision dated 25/11/2021 and numbered 2021/1187 on "accessing the corporate e-mail account of the data subject, who is a former employee, without informing the employee "
Subject: In the application, it is stated by the data subject that the contents of the correspondences that he/she had with his/her fiancée via e-mail, his/her personal bank statements and expenditure records were accessed by the data controller without any explanation or notification by the data controller stating that the e-mail addresses provided to the company employees shall be used only for business purposes and no controlling criteria in this regard have been determined and notified to the data subject; the personal data of the data subject has been processed and transferred to third parties, also after the cease of the data subject’s employment with the data controller, and the data subject has not been informed thereof and/or has been requested to provide his/her explicit consent. Furthermore, it is stated that since the information of the data controller’s customers and employees are stored in OneDrive cloud system provided by Microsoft, and the servers of the aforementioned service provider are located abroad, the aforementioned data processing needs to be carried out in accordance with Article 9 of the Personal Data Protection Law No. 6698 (“PDPL”), titled “international transfer of personal data”.
The following points set forth under the decision of the Board are important:
Review: The activities of monitoring the employees and controlling their communication should be carried out by the employers in a sensitive manner by taking into account certain criteria. Even if a corporate e-mail account has been provided by the employer for corporate activities and for business purposes, the employer has to inform the employee that the e-mail account will only be used for the purpose of performing the work and/or that his/her e-mails can be examined/controlled by the employer.
Should you have any queries on the above, please do not hesitate to contact us.
Güner Law Office was established in 1996 and has since grown into one of the major corporate, M&A, banking and finance, energy, TMT and dispute resolution practices in Turkey.
Burçak Kurt Biçer