Following the publication of the Ministry of Labor and Social Security's general letter on "Covid-19 Measures at Workplace" dated September 2, 2021, questions have risen regarding how employers should take action as data controllers within the scope of the Personal Data Protection Law ("PDP Law").

With the Covid-19 vaccine becoming prevalent, it has been one of the important topics in business life for some time whether the employer can make it mandatory for employees to get vaccinated or to submit a PCR test. In this context, the Ministry of Labor and Social Security (“Ministry”) has sent a general letter regarding the “Covid-19 Measures at Work” dated September 2, 2021, to the Governorships of all 81 provinces.

To evaluate the article in question within the scope of the PDP Law:

In the generalletter of the Ministry, it has been primarily stated that; employees whose Covid-19 vaccines that have not been completed create difficulty to ensure the occupational health and safety and create disruption in the labor peace by worsening the existing health and safety conditions of other employees and that employers are obliged to inform their employees about the protective and preventive measures against the health and safety risks that may be encountered in the workplace. In this context it has been stated that,

• Employers are obliged to inform all their employees about the protective and preventive measures against the health and safety risks that may be encountered in the workplace and to also inform their employees in writing, whose COVID-19 vaccines have not been completed,
   
• As a secondary notification, employers are expected to notify  employees, who are not vaccinated, of the possible consequences in case of a definitive diagnosis of COVID-19 in terms of the labor and social security legislations.
   
• Hence, employees who have not been vaccinated against COVID-19 may be required to provide a mandatoryPCR test  once  every week as of September 6, 2021 by the workplace/employer, and the test results may be registered at the workplace for necessary procedures.

First, it should be noted that data such as the information that takes place on the vaccination card of the employees and the PCR test results are considered as "health data", which is a special category of personal data within the scope of Article 6 of the 

PDP Law. Due to their nature, special categories of personal data are considered as sensitive data belonging to the the data subject; hence, if  discovered by a third party, it may cause the discrimination, ill-treatment or victimization of the person concerned. Therefore, sensitive data such as health data must be protected more strictly than other personal data. Special categories of personal data may be processed with the explicit consent of the data subject or within the limited exceptions listed in Article 6 of the PDP Law without explicit consent.

When evaluated in this respect, although the employer is obliged to take occupational health and safety measures; considering both the need for the PDP Law to find an application area primarily due to the legal hierarchy between PDP Law and the Ministry’s general letter, and by also taking into account the “Public Announcement” of the Personal Data Protection Authority (“Authority”) dated March 27, 2020, it would be appropriate to say that all personal data processing activities within the scope of combating COVID-19 should be carried out in accordance with the law and any measures taken in this regard should comply with the general principles of law.

Therefore, in order for the employers to act in accordance with the PDP Law and process the said health data, they must provide a privacy statement to the employees and collect the personal data (i) either by obtaining explicit consent from the data subject or (ii)  through the occupational physician or authorized institutions and organizations for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment, and care services, planning and management of health services and financing.

It should not be forgotten  that in case the health data processed by the occupational physician is obtained and processed by  units such as human resources, administrative affairs and security, which are not under the obligation to keep secrets before the employer, it will once again be required to obtain explicit consent from the relevant employees.

As a result, it is necessary to provide a privacy statement in accordance with the PDP Law and secondary legislation to the employees whose personal data will be processed due to the processes in question and to obtain explicit consent; if this process is desired to be carried out without obtaining explicit consent, it will be possible to process it for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment, and care services, planning and management of health services and financing, through  an occupational physician.

In light of the aforementioned, we would like to emphasize that the Authority has not yet made a public announcement regarding the general letter of the Ministry on "Covid-19 Measures at Work".