The Decision of the Court of Jurisdictional Disputes on Identity Verification by Hand Geometry

The decision of the Court of Jurisdictional Disputes dated April 13, 2026 and numbered 2024/361 E., 2026/211 K. was published in the Official Gazette dated November 8, 2026 and numbered 33424.

The decision concerns an administrative fine imposed by the Personal Data Protection Board ("Board") on an undertaking using a biometric terminal that reads hand geometry for access control. It was brought before the Court of Jurisdictional Disputes with a request for the resolution of two final and mutually conflicting judgments delivered in the administrative and judicial branches in respect of the same Board decision.

In this article, we address the subject matter of the decision, the assessments made by the courts, and the consequences of the arrangement for employers using biometric systems.

The Facts and the Board Decision

The claimant company used a biometric terminal reading hand geometry in order to verify the identity of its members upon entry to the facility it operated. According to the technical examination set out in the decision, the device scans the hand three-dimensionally from thirty-one thousand points and analyses the characteristics of the hand and the fingers, the length of the fingers, the distances between the points at which the fingers join, and the geometry of the joints of the fingers.

Upon the complaint of a member, the Board decided, by its decision dated July 7, 2022 and numbered 2022/662, to impose an administrative fine of TRY 100,000 on the company under Article 18/1-(b) of the Personal Data Protection Law No. 6698 ("Law"), on the ground that the obligation set out in Article 12/1 of the same Law had been breached.

The Board decision was not confined to the administrative fine. The Board further decided that the processing of biometric data for entry and exit purposes be suspended within the scope of Article 15/7 of the Law, that the hand geometry data processed and retained be destroyed in accordance with Article 7 of the Law and the Regulation on the Deletion, Destruction or Anonymization of Personal Data, and that, where such data had been transferred to third parties, those parties be notified without delay.

Recourse to Two Separate Judicial Avenues and the Resulting Conflict

The claimant company had recourse to two separate avenues against the same Board decision. On the one hand, it brought an action before the administrative courts seeking the stay of execution and the annulment of the decision, and on the other hand it lodged an objection against the administrative sanction with the criminal judgeship of peace.

In the administrative proceedings, the Ankara 20th Administrative Court dismissed the action on the merits by its decision dated November 16, 2023 and numbered 2023/495 E., 2023/1523 K. The appeal lodged against that decision was dismissed by the decision of the 10th Administrative Chamber of the Ankara Regional Administrative Court dated April 16, 2024 and numbered 2024/1466 E., 2024/2095 K., and the judgment became final.

In the judicial proceedings, the Sakarya 1st Criminal Judgeship of Peace partially allowed the objection by its decision dated March 8, 2023 and numbered 2022/6842. The judgeship reduced the amount to TRY 27,037, being the lower limit determined in accordance with the revaluation rate, on the ground that no matter requiring departure from the lower limit could clearly be identified. The objection lodged against that decision was dismissed by the decision of the Sakarya 2nd Criminal Judgeship of Peace dated April 7, 2023 and numbered 2023/1821, and the decision became final.

There thus emerged, in respect of the same Board decision, two final judgments, one upholding the fine in full and the other reducing the amount to approximately one quarter. The claimant company applied to the Court of Jurisdictional Disputes seeking the resolution of that conflict.

Hand Geometry as Biometric Data

Throughout the proceedings the claimant company argued that hand geometry could not be regarded as biometric data. On that argument, no data was collected owing to the manufacturing characteristics of the device, the device was used solely for identity verification, hand geometry did not constitute a special category of personal data since, unlike a fingerprint or a palm print, it did not vary from person to person, and the processing activity fell within the scope of Article 5/2 of the Law.

The administrative court did not accept that argument. In the court's view, the criterion required for data to be assessed as biometric data is that the data have the characteristic of being capable of identifying or authenticating only the person concerned. As the extraction of hand geometry constitutes a method of identity verification carried out through a physiological characteristic of the person and capable of automatic authentication, hand geometry must be accepted as biometric data.

The court also relied on the technical findings set out in the decision. According to those findings, hand geometry generates a nine-character code for each hand, each of those nine characters comprises thirty-six possibilities made up of ten digits and twenty-six letters, and the margin of error of the system therefore remains mathematically very low. The court accordingly concluded that the data was capable of matching the individual.

Given that biometric data, being a special category of personal data, may be processed only where the explicit consent of the data subject exists or where processing is expressly provided for in laws, no unlawfulness was found in the Board decision adopted on account of the claimant's processing without explicit consent.

The Determination of the Fine and the Proportionality Assessment

The most striking part of the decision in practical terms is the assessment of why the fine was determined above the lower limit.

The Court of Jurisdictional Disputes stated that, under Article 17/2 of the Misdemeanours Law No. 5326, where an administrative fine is determined by setting out a lower and an upper limit in the law, the unlawfulness content of the misdemeanour committed must be taken into account together with the fault and the economic situation of the offender in determining the amount.

Within that framework the Court highlighted two factors. The first is that the Authority had previously published two separate summaries of Board decisions on its website, informing the public and the sector that hand geometry information could not be processed without the explicit consent of the person concerned. The second is that the claimant had committed the misdemeanour of failing to fulfil its obligations relating to data security against more than one person, by processing without consent the personal data not only of the complainant but of all those holding membership of the facility.

The Court concluded that, where the gravity of the fault and the economic situation are assessed together, there was no breach of the principle of proportionality in the imposition of an administrative fine of TRY 100,000 departing from the lower limit of TRY 27,037 determined according to the revaluation rate.

The Operative Part

The Court of Jurisdictional Disputes decided to set aside the decision of the Sakarya 1st Criminal Judgeship of Peace dated March 8, 2023 and to accept the decision of the Ankara 20th Administrative Court dated November 16, 2023, which it found to be in conformity with the law and with procedure, thereby resolving the conflict of judgments.

The administrative fine of TRY 100,000 imposed by the Board therefore remains in place in full.

Assessment as Regards the Judicial Avenue

At the root of the dispute lies the uncertainty previously experienced as to which judicial avenue was to be followed against Board decisions. On account of that uncertainty, the claimant company had recourse both to the administrative courts and to the criminal judgeship of peace, and the two avenues produced different outcomes.

By the amendment made to Law No. 6698 by Law No. 7499, which entered into force in 2024, it was expressly provided that actions against administrative fines imposed by the Board are to be brought before the administrative courts. For this reason, there is no debate as to the judicial avenue in respect of Board decisions adopted after the amendment..

The decision is, however, of significance in respect of files in which recourse was had to the criminal judgeship of peace before the amendment and a reduction of the fine was obtained by that route. It may be considered that the approach of the Court of Jurisdictional Disputes to adopt the decision of the administrative court may provide guidance in respect of conflicting judgments of a similar nature.

Consequences for Employers

Although the decision was delivered with respect of the operator of a sports facility, the conclusions it reaches should also be assessed by employers using biometric systems for access control and time attendance tracking in the workplace.

First, it is apparent that the debate on biometric data is not confined to fingerprints. Hand geometry, facial recognition, palm vein patterns and similar methods will be subject to the same regime to the extent that they bear the characteristic of being capable of identifying or authenticating the individual. It may therefore be said that the technical name of the system or the characterization made by the manufacturer is not decisive, and that what is decisive is whether the data can match the individual.

Secondly, it appears that the argument that the device does not store the data does not in itself produce a result. The claimant company argued that the device did not collect data, but the court proceeded from the assessment that identity verification itself constitutes a processing activity.

Thirdly, it is noteworthy that the Authority's published decision summaries were used as an aggravating factor in relation to the fine. The fact that the Authority has published an assessment of a principled nature on a subject may weaken a data controller's defence of unawareness. It may be considered that this makes the regular monitoring of the Authority's publications a compliance obligation.

Fourthly, the number of persons affected by the breach directly influences the amount of the fine. Even where the complaint originates from a single person, the fact that the same practice has been applied to the entire body of employees or customers may be relied upon as the ground for departing from the lower limit.

Finally, it should be recalled that the Board decision was not confined to a fine. In the present case, it was also decided that the processing activity be suspended, that the existing data be destroyed, and that notification be given to the third parties to which transfers had been made. Those obligations are capable of requiring the access control infrastructure of the undertaking to be restructured.

Actions to Be Taken by Employers

Following the decision, it is important for employers using or planning to use biometric systems to review the following matters:

• Determining technically whether the access control and time attendance systems currently in use process biometric data. It should be borne in mind that methods such as hand geometry, facial recognition and vein patterns, and not only fingerprints, may fall within the scope.
• Not accepting as sufficient in itself any statement obtained from the supplier to the effect that the device does not store data or that it generates a template, and assessing separately whether the data generated by the device is capable of matching the individual.
• Determining the legal ground for processing biometric data and, where reliance is placed on explicit consent, assessing whether that consent has been given by free will. As the validity of employee consent is open to debate on account of the dependency inherent in the employment relationship, whether an alternative method is offered is of importance.
• Where a biometric method is to be used, actually offering the employee an equivalent alternative such as a card or a password, and ensuring that an employee choosing that alternative suffers no disadvantage.
• Assessing the processing activity in terms of proportionality and documenting whether the same purpose could be achieved by a less intrusive method.
• Taking the adequate measures determined by the Board under Article 6 of the Law and, within that scope, applying the measures listed in the Board decision dated January 31, 2018 and numbered 2018/10.
• Updating employee privacy notices, explicit consent declarations, the personal data processing inventory and VERBIS records so as to reflect the biometric data processing activity.
• Determining the retention period for biometric data and entering it into the retention and destruction policy, and defining the destruction process applicable where the employee leaves employment.
• Monitoring regularly the principle decisions and decision summaries published by the Authority and recording that such monitoring is carried out.

Conclusion

The decision reinforces two points in the field of biometric data. It has been confirmed by a judicial decision that physiological characteristics capable of identifying or authenticating an individual, including hand geometry, constitute biometric data and that such data cannot be processed without explicit consent. As regards the determination of the amount of the fine, it is apparent that the Authority's earlier publications and the number of persons affected by the breach were each used as aggravating factors.

It may be recommended that employers frame their fundamental control question as follows: "Does the access control or time attendance system used in the workplace process biometric data, if so what is our legal ground, is an equivalent alternative actually offered to employees, and has this activity been reflected in our privacy notices, our inventory and our VERBIS records?"

If there is no clear answer to these questions, determining technically which data the system in use generates will be the priority step.

You can access further details on this matter in the "Decision of the Court of Jurisdictional Disputes" published in the Official Gazette. (In Turkish)