Special Categories of Personal Data

Special categories of personal data are categories of data that, if disclosed, may lead to discrimination against or harm to the individual. Article 6 of the KVKK lists these categories exhaustively and makes their processing subject to much narrower conditions than other personal data.

Which Data Are Special Categories?

Under the KVKK, the following are special categories: data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. The list is exhaustive; data that seems sensitive, such as salary or bank details, is not a special category for that reason alone.

Processing Conditions: the 2024 Amendment

Law No. 7499 restructured Article 6 with effect from 1 June 2024. Under the previous system, the options other than explicit consent were very narrow: special categories other than health and sexual life could be processed without explicit consent only where provided for by law, and health and sex life data only by persons under a duty of confidentiality in the context of health services. The new rules introduced a common and broader list of conditions for all special categories. Special categories may now be processed on grounds such as explicit consent, express provision by law, physical impossibility, the data subject having made the data public, the establishment, exercise or protection of a right, the provision of health services, legal obligations in employment, occupational health and safety and social security, and the activities of non-profit organisations limited to their members.

Note that legitimate interest is not among these conditions. A company that can rely on legitimate interest for ordinary personal data cannot do so for the same processing if it involves special categories.

Adequate Measures

Processing special categories requires the adequate measures determined by the Board. These include technical and organisational measures such as training and confidentiality undertakings for employees with access, limiting and regularly reviewing access rights, encrypting the data and using secure methods for transfers. The Authority’s Guide on the Processing of Special Categories of Personal Data is the main reference in practice.

Common Situations in Practice

• Employee medical reports: May be processed under obligations arising from occupational health and safety legislation; however, keeping them in an HR file accessible to everyone breaches the duty to take adequate measures.
• Biometric access systems: Entering the workplace by fingerprint or facial recognition often raises proportionality concerns, since less intrusive methods (cards, passwords) are usually available.
• Criminal record certificates: May be requested only where expressly provided by law; requesting them routinely for every hire is unlawful.