Decision of the Board of Directors dated 24.02.2022 and numbered 2022/172 on the request for sensitive personal data from candidates employed during the recruitment process by the contact office of the controller residing abroad in Turkey
The following matters were briefly mentioned in the Complaint Request which is the subject of the Commission’s decision:
- While the data subject was accepted to work, the contact office which is the controller requested criminal record, health report, chest X-ray report, blood type document, photocopy of driver’s license, a photocopy of the marriage certificate and an identity card of family members, and these documents have been submitted by the person concerned;
- The contact office has not obtained the explicit consent of the data subject for the processing of the aforementioned sensitive personal data;
- Due to the fact that the controller resides abroad, the personal data of the data subject may also be transferred abroad.
In this regard, the Council has been requested to take the necessary measures.
In the letter sent by the data controller to the Commission following the data subject’s complaint, the following issues were addressed:
- The complainant is the contact office of the data controller from abroad, and it does not have individual legal personality or commercial activity according to legal principles;
- The work of the data subject within the organization of the controller is determined directly in accordance with the provisions of foreign legal legislation and, therefore, the labor register file was created in accordance with the provisions of the legislation in force in abroad;
- Since the personal data subject of the data subject’s complaint is the employee of the data controller residing abroad, the data subject’s consent has been obtained as part of the personal file at the place of work. . In this regard, there is no transfer of personal data abroad without permission in this case.
Following the investigation into this matter, the Commission declared that the notification made by the data subject to the contact office is legally valid, since the title of controller does not belong to the contact office, but to the stranger. based company itself, and because the head of the contact office is also the representative of the controller’s employer. However, the Commission has determined that it is not illegal to transfer data abroad in the concrete case complained of and that the personal data of the data subject are obtained through the contract concluded by the data controller residing abroad in the context of the commercial relationship. , in accordance with the law of the country of residence, but sufficient explanations are not provided to the person concerned. The Council stated that it is necessary to process the personal data of the data subject abroad for the performance of the employment contract, and for this, the explicit consent obtained from the data subject is lawful. Therefore, the Commission has decided not to impose administrative fines on the controller, but only to ask him to pay attention and take care of the requests of the data subject.
You can access the decision through this link.