Article 6 of the Turkish Data Protection Law (DPL) classifies biometric data in a special category of personal data; thus, a new guideline from the country’s Data Protection Authority (DPA) provides more clarity on how to treat this kind sensitive information.

“Issues to be Considered in the Processing of Biometric Data” (guideline), which the DPA published on its website on September 17, 2021, defines biometric data and further sets out principles in connection with its processing. The DPA published this guideline as a “principal decision”, therefore data controllers are required to comply with these principles while processing biometric data.

Regarding the definition of biometric data, the DPA has divided the types of biometric data into two groups:

1. Physiological biometric data—this includes fingerprints, retinas, palms, faces, hand shapes as well as a person’s irises, and
2. Behavioral biometric data—this can be kinesiological information, such as a person’s gait, gestures when scrolling a smartphone, a person’s keyboard or signature dynamics, and also their driving style.

The DPA sets forth principles in the guideline for processing biometric data as well as the technical and administrative measures to be taken in order to ensure the security of biometric data, as explained below.

Biometric data processing principles

• The data controller should process biometric data in accordance with the general principles stipulated by the DPL, e.g. lawfulness, proportionality, fairness, retention limitation.
• The purpose and means to be achieved with biometric data processing must be proportionate and one should avoid processing of biometric data if there are other less intrusive means available. 
• The data controller should specifically inform data subjects of the consequences that could arise in case of a data breach as well as the items that need to be specified under Article 10 of the DPL.
• Where the processing of biometric data is not explicitly permitted by the law, the data controller should obtain explicit consents of data subjects by explaining the reason for processing and the possible consequences of the data processing.
• The data controller should record and document that all the principles mentioned in the above points have been satisfied. 
• Unless it is necessary, genetic data (blood, saliva, etc.) should not be obtained. 
• Justifications and documentation about the process of choosing the type of biometric data (e.g. iris, fingerprint, vascular network of the hand, etc.) should be made.  
• The maximum retention period for biometric data should be determined, and the data should be destroyed without delay once the purpose of the retention no longer exists. Reasons for the data retention periods should be specified in data retention and destruction policy. 

Technical Measures

• Biometric data kept in cloud systems should only be stored using cryptographic methods. 
• Derived biometric data should be stored in a format that does not allow the recovery of the original biometric feature.
• Biometric data and its templates should be encrypted by cryptographic methods, and the encryption and key management policy should be clearly defined.
• Before installing the system for taking and storing the biometric data and after any changes to the system, the data controller should test the system using synthetic data. During test studies, the use of actual biometric data should be limited to only the data necessary and should be deleted upon completion of the tests at the latest.
• The data controller should (i) use certified equipment, licensed and up-to-date software, (ii) prefer using open-source software primarily and (iii) regularly make the necessary updates to its systems.
• The data controller should be able to monitor and limit user actions on the software that processes biometric data. In the event of unauthorized access to the system, measures should be taken to warn the system administrator and, when necessary, to delete the biometric data.
• The life cycle of the devices used to process biometric data should be monitored and hardware/ software tests of the data system should be exercised regularly.

Administrative Measures

• Alternative systems should be offered to data subjects who (i) cannot use the biometric solution or (ii) do not give their explicit consent to the processing of biometric data.
• An action plan should be prepared in the event of failure of authentication by biometric methods.
• Access controls to biometric data systems should be established, managed, and documented.
• Trainings given to the personnel involved in biometric data processing activities must be documented.
• A reporting and emergency procedure should be established and announced by the data controller so that employees can report possible security weaknesses and threats.