Employee Privacy in the Age of Algorithmic Surveillance: To What Extent Can Employers Monitor Employees with AI?

Entrance

Artificial intelligence systems are no longer used in workplaces solely for tasks such as text preparation, responding to customer requests, or generating reports. Applications such as monitoring employee computer activity, analyzing email traffic, evaluating camera footage, tracking location information, generating performance scores, and predicting employee behavior are also becoming increasingly common.

An artificial intelligence system can analyze which programs an employee uses, how much time they spend at the computer, how much they speak in meetings, or which words they prefer in conversations with clients. Based on this data, conclusions can be drawn about the employee such as "productive," "low-performing," "high risk of leaving," "weak commitment to the organization," or "may experience disciplinary problems.".

The Personal Data Protection Authority also points out that the use of productive artificial intelligence in workplaces often develops based on the individual preferences of employees without a clear corporate policy, and that this makes it difficult to monitor and manage the use of artificial intelligence.

However, the employer's right to manage work organization, measure performance, and ensure information security does not mean they can monitor employees without limit. An employee's presence at the workplace or use of the employer's computer cannot be interpreted as a waiver of their right to privacy and protection of personal data.

Therefore, the fundamental question regarding employee privacy in the use of artificial intelligence is this:

Where does the employer's right to manage and supervise end, and where does the employee's right to privacy and protection of personal data begin?

What does employee privacy mean?

Employee privacy refers to the protection of an employee's rights to privacy, communication, personal data, and personality within the scope of their employment relationship.

Privacy is not limited to an employee's private correspondence. It also includes the employee's;

• Its image and sound,
• Email and messaging content,
• Internet usage records,
• Computer and application activities,
• Location information,
• Health and disability information,
• Biometric data,
• Trade union activities,
• Their religious or political views,
• Performance and discipline records,
• The commands he wrote to artificial intelligence systems,
• Scores and predictions generated about it by artificial intelligence

It may constitute personal data or information relating to private life.

Article 20 of the Constitution stipulates that everyone has the right to demand respect for their private and family life and to request the protection of personal data concerning them. This right includes the right to request information about oneself, access to data, correction or deletion of data, and to learn whether data is being used for its intended purposes.

The fact that an employment relationship is a dependent one does not negate the worker's constitutional rights. The employer's economic and managerial superiority does not result in privacy being left entirely to the employer's discretion.

Can an employer's right to manage restrict privacy without limit?

Employers have legitimate interests in supervising the conduct of work, ensuring the appropriate use of workplace equipment, protecting data security, and evaluating employee performance.

However, Article 417 of the Turkish Code of Obligations imposes on the employer the obligation to protect and respect the employee's personality. The employer is obliged to ensure an order in the workplace that conforms to the principles of honesty and to compensate for any damages that may arise from the violation of the employee's personal rights.

According to Article 419 of the Turkish Code of Obligations, an employer may only use an employee's personal data to the extent that it is related to the employee's suitability for the job or is necessary for the performance of the employment contract.

Article 75 of the Labor Law also obligates employers to use information obtained about employees in accordance with the law and principles of fairness, and not to disclose information that the employee has a legitimate interest in keeping confidential.

When these regulations are considered together, it can be concluded that employers do not have the authority to collect, store, and analyze all employee data that they can technically access using artificial intelligence.

The tracking process;

• It must be based on a specific and legitimate purpose,
• It must be necessary for the conduct of the business,
• It should be relevant to the purpose and proportionate
• A less intrusive approach should not be found
• This should be explained to the employee in advance
• It should not be used for purposes other than those specified.

Is AI-powered monitoring considered personal data processing?

Collecting, recording, classifying, analyzing, or making predictions about an employee's information through an artificial intelligence system may constitute a personal data processing activity.

For example, a system recording the time an employee spends at their computer is not merely a technical tracking process. If the system assigns a performance score to the employee based on these records, then both activity data is being processed and new personal data about the employee is being generated.

According to Article 5 of the KVKK (Law on Protection of Personal Data), the processing of personal data requires explicit consent or one of the other data processing conditions stipulated in the Law. The performance of an employment contract, the employer's legal obligation, the establishment or protection of a right, or the employer's legitimate interest (provided that it does not harm the employee's fundamental rights) may constitute grounds for data processing, depending on the specific circumstances of the case.

However, the mere existence of a legal basis is not sufficient. Data processing activities must be carried out in accordance with the law and principles of fairness, for specific and legitimate purposes, and in a manner that is relevant to, limited to, and proportionate to those purposes.

The employer's abstract explanation of "increasing productivity" or "maintaining overall control" does not constitute sufficient justification for the continuous monitoring of all employee activities.

Does an employee's explicit consent make every surveillance method legally permissible?

Obtaining explicit consent from an employee does not automatically render all monitoring activities lawful.

Firstly, there is an economic and managerial power imbalance between the employee and the employer. The employee may give consent out of fear that they will not be hired, will not be promoted, or will lose their job if they do not consent. Therefore, whether explicit consent is based on free will should be evaluated separately in the specific case.

Furthermore, the principles of relevance to the purpose and proportionality in the processing of personal data continue to apply even with explicit consent. Employers cannot obtain unlimited monitoring authority by having employees sign a general document stating, "I agree to the monitoring of all my digital activities.".

In its decision regarding fingerprint-based attendance tracking, the Constitutional Court emphasized that personal data can only be processed in cases stipulated by law or with the explicit consent of the individual; furthermore, the intervention must be lawful, necessary, and proportionate.

Therefore, explicit consent is only one of the legal grounds; it is not a general permission that eliminates the employer's obligations of necessity, transparency, and proportionality.

The employee must be informed in advance

Before employee tracking is implemented through artificial intelligence, employees should be provided with detailed and clear information.

At least in terms of lighting;

• Which artificial intelligence system will be used,
• Which personal data will be collected?
• From which sources the data will be obtained,
• The purpose for which the monitoring will be carried out,
• Whether a score or profile will be created by the system,
• Whether the results will be used in performance, promotion, or termination decisions,
• With whom the data will be shared,
• Whether or not a transfer will be made abroad,
• What is the storage period?
• Employee's rights to object and appeal

It should be explained.

Under the KVKK (Turkish Personal Data Protection Law), data protection information must be provided at the time of data collection and must include information about the data controller, the purpose of processing, the legal basis, the transfer of data, and the rights of the data subject.

The general statement that "corporate devices can be monitored by the employer" should not be considered sufficient when it comes to serious operations such as taking screenshots, recording keyboard activity, reading emails with artificial intelligence, and generating predictions about the employee's psychological profile.

Providing information alone does not make the surveillance legally compliant. The surveillance must also be necessary and proportionate.

AI Analysis of Corporate Emails

Employers can use AI systems to scan corporate emails for malware, data leaks, trade secret breaches, or use that violates company policies.

However, there is an important difference between analyzing the traffic data of communications and examining their content.

Traffic data such as the date and recipient of an email, whether it contains attachments, or whether it left the company constitutes a more limited form of interference. However, reading the message content and analyzing it through artificial intelligence is a more serious interference with freedom of communication.

In its decision numbered 2023/86, the Personal Data Protection Board considered the legal aspects of informing the employee in advance, explaining that the corporate email will be used for business purposes, and specifying the scope of the audit in the policy texts.

The Constitutional Court is also subject to institutional email surveillance;

• Whether the employee was informed beforehand,
• whether the employer has a legitimate purpose,
• Whether the audit is limited to the purpose
• Whether a less intrusive method exists,
• Within what scope are the correspondence contents examined?

is evaluating.

Therefore, having artificial intelligence constantly read all employee communications to analyze "loyalty," "emotions," "stress," or "risk of leaving" is a far more serious intrusion than limited and purposeful email monitoring based on specific security concerns.

Messaging Apps and Private Correspondence

The fact that a message is found on the employer's computer or in the workplace's shared messaging system does not automatically mean that it belongs to the employer.

Employees may use corporate devices for personal communication, albeit to a limited extent. Unless the employer explicitly states that personal use is strictly prohibited and that communications may be reviewed under certain conditions, employees may have a certain expectation of privacy.

The Constitutional Court examined the use of content accessed without the employee's consent in the termination of their employment contract, considering it within the scope of respect for private life and freedom of communication, and ruled that there was a violation in this specific case.

Automated message scanning via artificial intelligence can process not only information about the employee but also data belonging to the other parties in the correspondence. Therefore, the impact of monitoring activities on the rights of third parties should also be evaluated.

AI Analysis of Camera Images

The use of security cameras in workplaces may be legally permissible under certain conditions. Concrete purposes such as preventing theft, ensuring workplace safety, and securing cash registers and warehouses may justify the use of cameras.

However, using security cameras to measure employee productivity, monitor break times, analyze body language, or create performance scores for employees is a different and more complex data processing activity.

The Personal Data Protection Authority's statement regarding workplace cameras dated 2026 states that the purpose of camera use must be predetermined, data minimization must be adhered to, and recordings obtained for security purposes should not be used for different purposes such as performance or attendance tracking. The Authority also clarified that abstract purposes such as monitoring employees, providing general control, or measuring productivity cannot be considered legitimate purposes in themselves.

The cameras' field of view and placement are also important. While limited recording may be possible in areas such as entrances, exits, cash registers, and storage rooms, the use of cameras in private areas such as restrooms, changing rooms, and breastfeeding rooms cannot be considered legally compliant.

Audio recording constitutes a more serious intrusion into privacy than video recording. The Personal Data Protection Board's decisions state that even in cases where video recording may be necessary for security purposes, continuous audio recording may not be equally necessary or proportionate.

Facial Recognition and Biometric Tracking

Data such as facial geometry, fingerprints, iris, or voice patterns are biometric data that enable the unique identification of an individual and are considered special categories of personal data.

The Personal Data Protection Board, in its decision regarding the use of facial recognition systems and cameras in the workplace, evaluated whether there was a legal basis, proportionality, and whether less intrusive methods were available for the processing of biometric data.

While attendance tracking can be done through less intrusive methods such as employee ID cards, passwords, attendance sheets, or similar tools, using facial recognition or fingerprint scanning solely for convenience or speed can be considered disproportionate.

Since biometric data, once leaked, cannot be changed like a password, the employer's security and data minimization obligations are greater. In the processing of sensitive data, adequate measures determined by the Board must also be taken.

Screenshot, Keyboard and Mouse Tracking

Some AI-powered tracking systems take periodic screenshots of an employee's computer screen, recording keystrokes, mouse movements, applications used, and periods of time spent motionless at the computer.

Such practices affect not only the employee's work activities;

• His private correspondence,
• Banking transactions,
• Health information,
• Union communication,
• Seeking legal advice,
• Information belonging to third parties

It can also reveal.

An employer's need to monitor remote work does not automatically justify continuous recording of the employee's entire screen. If the outcome of the work can be measured through submitted reports, completed tasks, and objective performance criteria, continuous screen and keyboard recording may not be required.

Furthermore, AI systems can produce inaccurate conclusions about employee productivity by classifying time spent thinking, reading, making phone calls, or attending meetings as "inactivity.".

Therefore, screen and keystroke monitoring should only be considered in exceptional circumstances where there is a very strong security or business requirement, a less stringent method is insufficient, and the scope of monitoring is clearly limited.

GPS and Location Tracking

For field workers, couriers, drivers, or employees using company vehicles, GPS tracking may be necessary to a certain extent. Purposes such as ensuring delivery, vehicle security, or determining working hours may justify processing location data.

However, location tracking;

• Only by working hours,
• With work-related tools or equipment,
• Following the specified task and route,
• With the required storage time

It should be restricted.

If a company vehicle is permitted for private use, monitoring all of an employee's movements outside of working hours could constitute an excessive intrusion into their privacy.

If an artificial intelligence system makes inferences about an employee's private life, health status, religious activities, or union affiliations from their movements, the tracking process goes beyond its initial purpose of ensuring tool security.

Monitoring AI Commands

Employers may, to a certain extent, monitor the commands that employees enter into the corporate AI account for information security and data leakage prevention purposes.

However, the commands a worker wrote to artificial intelligence;

• Health problem,
• Pregnancy,
• Psychological state,
• Trade union problem,
• Dispute in the workplace,
• Job search activity,
• The need for legal advice,
• Political or religious views

It may contain confidential information.

Therefore, maintaining command logs should not be considered merely a technical record-keeping process. Instead of storing all commands indefinitely, employers should filter, anonymize, or limit the retention period of necessary information for data security purposes.

Employees should be clearly informed that instruction logs are visible to the employer, the purpose for which they will be analyzed, and whether they will be used in disciplinary or performance processes.

Emotion, Character, and Personality Analysis

Some artificial intelligence systems aim to analyze employees' emotions and personalities from their tone of voice, facial expressions, word choices, or camera footage.

These systems can classify employees as “stressed,” “prone to anger,” “low loyalty,” “suitable for leadership,” or “close to leaving.”.

Such an assessment constitutes a serious intrusion into employee privacy. Furthermore, it is highly debatable whether reliable psychological conclusions can be drawn from facial expressions and tone of voice, and whether disability and cultural differences could lead to misinterpretation.

From a comparative law perspective, the European Union Artificial Intelligence Regulation (AID) prohibits the use of emotion recognition systems in the workplace, except for limited exceptions for medical or safety purposes; it also classifies recruitment, employee management, task assignment, and performance monitoring systems as high-risk areas. Employers are required to inform employees and employee representatives before using high-risk systems.

While these provisions do not apply directly to every Turkish employer, they constitute an important comparative legal standard regarding employee privacy.

Creating Profiles with Artificial Intelligence

Artificial intelligence systems can create a comprehensive profile of an employee by piecing together the collected data.

For example;

• Email sending hours,
• Attendance at meetings,
• Sickness and leave records,
• Computer activity,
• Customer complaints,
• Communication with colleagues,
• Work entry and exit times

By evaluating these factors together, an employee's performance, loyalty, or likelihood of leaving the company can be predicted.

These types of profiles carry more significant implications than individual data points, because artificial intelligence doesn't just record existing information; it generates a new assessment of the employee that didn't exist before.

It is incorrect to assume that the generated score or prediction represents objective reality. The system may produce inaccurate results based on incomplete, flawed, or biased data.

According to Article 5 of the Labor Law, discrimination based on gender, disability, political opinion, religion, or similar reasons is prohibited in employment relationships. The fact that artificial intelligence does not directly use these characteristics does not mean that it does not produce discriminatory results through indirect data.

Fully Automated Decision-Making and the Employee's Right to Appeal

Article 11 of the KVKK (Law on Protection of Personal Data) grants individuals the right to object to a result that is detrimental to them, which arises solely from the analysis of personal data through automated systems.

This provision states that the artificial intelligence system;

• Considering the employee to be underperforming,
• Reducing his premium,
• Being placed in an unfavorable shift,
• Removing him from the promotion list,
• Initiating the disciplinary process,
• Suggesting that he be fired

It is important in situations such as these.

The employer's mere formal approval of the algorithmic result may not constitute genuine human oversight. The person performing the human oversight must:

• Being able to analyze the data used,
• The system should be able to question the outcome,
• To be able to evaluate the employee's statements,
• Having the authority to change the decision

is necessary.

Leaving crucial decisions affecting an employee's professional and economic future to an unexplained and unchallengeable algorithm raises issues of privacy, fair treatment, and job security.

How long can the collected data be stored?

Employee records, including images, emails, screen activity, location data, or AI usage logs, cannot be stored indefinitely.

The retention period should be determined taking into account the purpose of data processing and legal obligations. Data must be deleted, destroyed, or anonymized when the purpose no longer exists.

The Regulation on the Deletion, Destruction, or Anonymization of Personal Data governs the procedure for deleting or destroying data upon the request of the data subject, and the data controller's obligation to take the necessary technical and administrative measures.

Employers cannot store all of an employee's digital history on the grounds that "it might be needed in the future." A separate retention period must be determined for each data category.

Whose responsibility is data security?

Outsourcing employee tracking systems does not absolve the employer of their responsibilities.

The employer should examine what data the system collects, where the data is stored, whether the service provider uses the data for its own purposes, and whether any data is transferred abroad.

According to Article 12 of the KVKK (Law on Protection of Personal Data), the data controller is obliged to take the necessary technical and administrative measures to prevent the unlawful processing and access of personal data and to ensure the secure storage of data.

In this context;

• Access rights should be restricted
• Records must be encrypted
• It should be determined which manager has access to which data
• System activity should be logged
• A data breach response process should be established
• Data protection agreements should be made with service providers.

Sharing an employee's confidential data with all managers or colleagues may also constitute an unlawful disclosure. The Personal Data Protection Board evaluates the mass sharing of personnel information with unrelated employees within the scope of the principles of purpose limitation and proportionality.

Can the results of an unlawful enforcement proceeding be used as grounds for termination of a contract?

Records generated by artificial intelligence systems can be used in disciplinary or termination proceedings. However, these records must be obtained legally, be accurate, and reflect the employee's actual activities.

Using data obtained from a surveillance system—where the employee was not informed beforehand, private correspondence was secretly reviewed, or excessive and continuous monitoring was conducted—as grounds for termination may render the termination questionable.

Performance scores generated by artificial intelligence are not conclusive evidence. The court ruled;

• The source of the data,
• The system's margin of error,
• The objectivity of the criteria,
• The legality of the surveillance,
• The employee's defense,
• Whether or not there is human supervision

can examine.

The employer cannot escape the burden of proof and justification by simply stating, "The system evaluated it that way.".

The unlawful nature of the harassment may also lead to sanctions under the Personal Data Protection Law (KVKK), claims for material or moral damages due to violation of personal rights, and, depending on the specific circumstances of the case, disputes regarding reinstatement or unpaid wages.

What can an employee do against unlawful surveillance?

The employee, by applying to the employer within the scope of Article 11 of the Personal Data Protection Law (KVKK),

• whether your personal data is being processed,
• Which data was collected?
• For what purpose the data is used,
• With whom it was shared,
• Which profiles or scores were generated by the artificial intelligence system,
• Whether the data has been transferred abroad

can ask.

The employee may also request that incorrect or incomplete data be corrected, deleted if the conditions are met, and that any unfavorable findings from automated analysis be reviewed by a human.

If the employer rejects the application, provides an inadequate response, or fails to respond within the specified time, a complaint may be filed with the Personal Data Protection Board.

It also works according to the specifics of the case;

• Reinstatement in labor court,
• Material and moral compensation,
• Compensation for discrimination,
• Labor claims,
• Objection to illegally obtained evidence

They can resort to these methods.

How should a legally compliant AI tracking system be established?

The employer must conduct a written and concrete risk assessment before implementing an AI-powered monitoring system.

In a legal system;

1. The purpose of the surveillance must be clearly defined.
2. Whether less intrusive methods are sufficient should be investigated.
3. Only necessary personal data should be processed.
4. Employees should be provided with detailed information.
5. Covert surveillance should, as a rule, be avoided.
6. Work and private areas should be separated as much as possible.
7. High-risk decisions should be subject to human oversight.
8. Employees should be given the opportunity to challenge the algorithmic result.
9. Storage durations for camera, audio, screen, and location recordings should be determined.
10. Who can access the data should be restricted.
11. The artificial intelligence system should be regularly monitored to determine whether it produces discriminatory or inaccurate results.
12. The monitoring system should also be evaluated in terms of employees' psychological health and workplace harmony.

Employer-developed employee privacy and AI policies should not consist solely of unilateral provisions stating that "the employer can monitor all systems." The policy must consider both employee protection and the employer's legitimate security needs.

Conclusion

The use of artificial intelligence in the workplace does not legally permit employers to monitor employees without restriction.

Employers may conduct specific monitoring activities to manage work organization, evaluate performance, ensure data security, and prevent misuse of workplace tools. However, this monitoring;

• It must be based on a specific and legitimate purpose,
• It should be necessary and proportionate
• This should be explained to the employee in advance
• It should be limited to data relevant to the purpose
• It should not infringe upon the employee's privacy.

In particular, continuous screen and keyboard monitoring, AI-controlled analysis of all email content, emotion extraction from facial expressions and voice, tracking off-hours location, and the creation of confidential employee profiles pose serious legal risks.

The fact that the artificial intelligence system has been purchased by the employer or that the process is automated does not transfer the responsibility to the algorithm. The employer, who chooses the system, provides the data to the system, uses the results, and makes decisions about the employee, continues to bear legal responsibility.

Employees' privacy doesn't end at the door of the workplace. Being in the workplace doesn't mean giving up the right to personal data and respect for private life.

In conclusion, the lawful use of artificial intelligence requires not a digital surveillance system that constantly monitors and rates employees, but rather a transparent, measured, secure, and effective system subject to human oversight, limited only to concrete needs.

Artificial intelligence can oversee business processes; however, it cannot eliminate an employee's right to privacy, human dignity, and control over their personal data.