The KVKK's Email Decision and the Limit of Workplace Surveillance

Whose Is the Mailbox?

October 8, 2026 at 11:01 PMAuthor: Oğuz Demirkapı

Whose Is the Mailbox? The KVKK's Email Decision and the Limit of Workplace Surveillance

The Server Is the Boss's, the Word Is the Worker's

Dear young comrades,

Today, on 8 October 2026, a decision that looks small but touches the everyday life of millions of employees was published in the Official Gazette. The Personal Data Protection Board took a principle decision on how, and to what extent, the employer may supervise corporate email accounts and the other channels of communication used for work. The first place we read the news was bianet; the headline catches the core of the decision well: The employer cannot supervise the employee's emails without limit.

As always, I will first tell briefly what happened. Then we will move to the detail, to the legal background, to the class meaning of the decision, and to what we can do.

In brief: what happened, and what does it mean?

The decision: The principle decision of the Personal Data Protection Board dated 16 September 2026, No. 2026/2035. It was taken by majority vote and published in the Official Gazette dated 8 October 2026, issue 33394. It sets out procedure and principles in 16 articles.
Scope: Corporate email, in-company messaging applications, corporate instant-communication accounts, the chat and recording areas of meeting platforms, customer-relations and request-management systems.
The occasion: Complaints and reports that reached the Board. It was found that employers were monitoring email accounts, accessing the content of correspondence, examining traffic and log records, and using the information obtained in disciplinary investigations and in dismissals, and that employees were not sufficiently informed of this.
The main principle: Providing the account, or owning the server, in the Board's words, "does not, by itself, grant the employer an unlimited and absolute power of supervision."
What is forbidden: Secret monitoring that was not notified in advance, and "tools that record all of the employee's transactions without distinction," are unlawful.
Graduated steps: First the least intrusive path. Looking at content is the exception; only if there is a concrete suspicion and a limited claim. A problem that can be solved by filtering or by blocking access does not justify reading correspondence.
Consent: Because of the imbalance of power in the employment relationship, the employee's "explicit consent" is, as a rule, not counted as a valid basis.
Notification: A general sentence of the kind "your corporate email account may be supervised" is not enough. The purpose, the scope, the method, the legal ground, the cases in which content will be accessed, the retention period, and the employee's rights must be written in advance and plainly.
Personal accounts: Being able to access something technically does not give a legal right of access. The employee's personal email, private messages and social media are not the employer's domain.
The employee who leaves: The account is, as a rule, closed; forwarding, an automatic reply, or archiving may be done only for a concrete need, for a limited time, and on record.
The sanction: Data controllers who do not comply will be proceeded against under Article 18 of Law No. 6698. The decision states no specific amount of fine.

Our short comment: This is a real gain in the worker's favour, and it should be used. But between a gain existing on paper and its being applied in the workplace there is, as always, a distance as wide as organisation. The decision is also important in that an institution of the state accepts, in an official text, that there is an imbalance of power between worker and employer. Note this admission; we will return to it below.

Let us now move to the detail.

What does the decision say? The language of the articles

The full text of the decision is in the Official Gazette. Let me group and recount the provisions reflected in the news and in the summaries on legal sites; because the force of the decision lies less in the articles one by one than in the logic these articles draw together.

Property does not mean authority. This sentence is the spine of the decision. The employer cannot say "the account is mine, the server is mine, the computer is mine, therefore everything inside it is mine." Whose the account is is one thing; whose data is inside the correspondence that passes through that account is another. Correspondence is your word; it is your correspondent's word.

The log record is personal data too. Not only content, but who wrote to whom and when, how long one stayed online, and which file one opened at which hour, is also counted as personal data. This detail matters; because a large part of workplace surveillance consists not of reading content, but of collecting this "metadata" and building a profile.

A graduated approach. If there is a less intrusive path, the heavier one cannot be used. The order is this: first technical measures (filtering, blocking access), then an examination of traffic and logs without touching content, and last, and only if there is a concrete suspicion, a limited examination of content. A "general and continuous" examination is counted as disproportionate.

A ban on personal use is not a key. The employer may set a rule on the personal use of work tools; but the employee must know this in advance. And, most important, breaching this ban does not by itself legitimate the reading of private correspondence. The defence "personal use was forbidden, so I read everything" no longer holds.

A narrower reading where use is mixed. In situations where work and private communication cannot be separated from each other, the employer's authority will be read more narrowly. This is an approach that fits the reality of the employee who writes from their phone both for work and to their spouse, and who talks in the same application both with the customer and with a friend.

Technical access and legal access are separate. The Board writes this plainly: "the possibility of technical access and the legal authority of access must be separated from each other." The company's device-management software may be able to see everything on your phone. This does not mean it has the right to see it.

Notification must be concrete. A general sentence, "you may be supervised," is not enough. The legal ground, the purpose, the scope, the method, the cases in which content will be accessed, how long the data will be kept, and the employee's rights under Article 11 of the Law must be written.

Consent is given inside a power relation. The Board says that explicit consent does not automatically permit every kind of supervision, that because of the imbalance of power in the worker–employer relationship it cannot, as a rule, be a primary basis, and that whether consent was given freely must be assessed separately.

Data security and third persons. The authority to access correspondence should be limited to the task, accesses should be put on record, and those who access should be under a duty of confidentiality. That correspondence may contain special-category data such as health data, and information belonging to the correspondents, will also be taken into account in the supervision.

The account of the employee who leaves. The account is closed to active use and to new access, incoming messages are not allowed to be seen by unrelated persons, and data that no longer has a legal basis is destroyed. Forwarding or archiving may be done for business continuity, the right of defence, or a statutory requirement; but in a limited, time-bound and recorded form.

Why now? Before the paper, there was the complaint

The decision did not come down from the sky. According to the Board's own account, it came with complaints and reports. It is not hard to guess what stands behind these complaints: employees who were dismissed, who were asked for a defence, who were referred to a disciplinary board, and before whom their own correspondence was placed as "evidence."

This principle decision is the second major workplace-surveillance decision of the same year. In its principle decision No. 2026/921, taken on 29 April 2026 and published in the Official Gazette on 2 June 2026, the Board had counted the tracking of working hours by fingerprint, facial recognition, and iris and retina scan as unlawful. The ground is of the same family as today's decision: there is no explicit statutory basis, the worker's consent is not free because of the imbalance of power, biometric data is irreversible, and it is disproportionate for a simple administrative purpose (bianet English).

So within six months the Board struck the same place twice: workplace surveillance is not a natural extension of the employer's right of property. First the body itself (fingerprint, face), now the word (correspondence). This is a tendency, and the source of the tendency is not the Board's spontaneous enlightenment, but surveillance at the workplace reaching an unbearable scale, and the complaints rising against it.

The legal background: Strasbourg, Ankara, and the labour courts

To understand this decision fully, one needs to know the previous two links.

Bărbulescu v. Romania (ECtHR Grand Chamber, 5 September 2017). A Romanian engineer had been dismissed for corresponding with his fiancée and his brother from a Yahoo Messenger account the employer had asked for; the employer had transcribed the correspondence and put it in the file. The Chamber of the ECtHR first said there was no violation; the Grand Chamber reversed this judgment and held that the right to respect for private life (ECHR Article 8) had been violated. The Grand Chamber set criteria for the supervision of communication at the workplace: prior and clear notification, a separate assessment of the scope of the supervision and of the flow and the content of the communication, a legitimate ground especially for access to content, whether less intrusive methods existed, how the results of the supervision were used, and the safeguards provided to the employee (Hukuki Haber). Someone reading today's KVKK decision sees that these criteria have been carried into Turkish almost one to one.

The Constitutional Court: E.Ü. (2020) and C.O.A. (2021). The Constitutional Court took these criteria into its own case law, but in the end left the employer a wide field. In the C.O.A. judgment of 12 January 2021, it found no violation in the dismissal of an employee who worked at a bank and who was alleged to have done business, by corporate email, for his spouse's company. The ground: the employment contract stated that email would be used only for work and could be supervised without notice, the examination was limited, and the courts had also assessed other evidence (Hukuki Haber). The Court had accepted that, because of this clause in the contract, the employee had given consent.

The real novelty of today's decision is here. The logic the Constitutional Court accepted in 2021, "we wrote it in the contract, they signed, they gave consent," is openly weakened by the KVKK in 2026: a general sentence of supervision is not enough, and consent in the employment relationship cannot, as a rule, be a basis. You are not counted as having given up your privacy by a sentence on the ninth page of the fifteen-page contract placed before you when you start the job.

One more note: Article 189 of the Code of Civil Procedure says that evidence obtained unlawfully cannot be taken into account by the court. After this principle decision, the evidentiary value of correspondence obtained by secret monitoring or by a disproportionate examination of content will be debated again in reinstatement cases. How this will turn out will be shown by the practice of the labour courts and of the Court of Cassation; but workers' lawyers now have an official text of criteria in their hands.

The employer's language, the Board's language

What the decision has changed is seen most plainly when it is set beside the sentences we have heard for years in workplaces.

What has been said for years at the workplace	The Board's decision of 8 October
"The account is the company's, everything inside it is the company's."	Providing the account does not by itself give an unlimited and absolute power of supervision.
"It is written in the contract, you signed."	A general sentence, "it may be supervised," is not enough; purpose, scope, method and retention period must be written.
"You gave consent."	Because of the imbalance of power in the employment relationship, consent is, as a rule, not a primary basis.
"Personal use was forbidden, we read it."	Breaching the ban does not by itself justify reading private correspondence.
"Our system records everything."	Tools that record all transactions without distinction, and secret monitoring, are unlawful.
"We can reach it from the computer, we will look."	The possibility of technical access is not a legal authority of access.
"There is a problem, let us examine all their correspondence."	First the filter and the log; content only with a concrete suspicion and a limited claim.
"They left, but let the account stay open, we will look at what comes in."	The account is, as a rule, closed; the exceptions are limited, time-bound and recorded.

I suggest you multiply this table, hang it on your workplace board, and share it with your union representative. Legal texts become the worker's instrument only when they are translated into the worker's language.

A class reading: why is the mailbox a question of property?

Let us now leave the technical detail of the decision and look at what we are debating. With the three questions we always ask: In whose hands? Under whose control? To whose benefit?

The server is the boss's, the word is the worker's

In the capitalist workplace the means of production belong to capital. In the factory this is the bench; in the office block it is the computer, the server, the software licence, the email account. Capital thinks that owning the means of production also means owning every trace of the labour that works on that means. Taylor's chronometer aimed to measure the worker's every movement and to count the second as the employer's property. In the digital workplace the chronometer is now on the screen: the keystroke counter, the "productivity" software that takes screenshots, the measurement of time online, the analysis of correspondence. We call this mental Taylorism. Mental labour too is now split into pieces and measured, like manual labour; and measurement becomes the instrument of supervision, and supervision the instrument of discipline.

The Board's sentence "property does not give unlimited authority" draws a limit exactly on this logic. The worker's correspondence is not a good produced on the employer's bench; it is a relation a person establishes with other people. Inside it there may be health information, a union conversation, or a customer's private problem. Capital's owning the means of production does not mean owning this relation. This sentence, even on a small scale, gives a ruling in favour of the human right in the conflict between the right of property and the human right.

Surveillance is transparent downward, opaque upward

When we discussed KVKK's "80s trend" warning, we said this: in the digital panopticon, surveillance is transparent downward and opaque upward. The employee's correspondence is "supervisable"; the board of directors' correspondence is a "trade secret." The worker's log record enters the disciplinary file; the company's tax-restructuring correspondence enters nowhere.

This decision does not remove this asymmetry; but it limits the transparency downward. Inside this limit it is accepted that the worker's correspondence is an area of freedom of communication, and that the employer can enter this area only in a way that is accountable, reasoned and recorded. That is, surveillance itself is also put under surveillance: who accessed, when, on what ground, all of it must be on record. This is a small piece, for the worker, of a panopticon turned the other way.

The class content of consent

The most important sentence of the decision, to our mind, is that an institution of law writes that there is no equality in the employment relationship. Liberal law sees the employment contract as an agreement made by the free will of two equal parties. Marx mocks this equality as "the kingdom of Freedom, Equality, Property and Bentham"; because this equality in the sphere of circulation disappears the moment one enters the sphere of production. The consent of a person who signs in order not to lose their job, who ticks the "I accept" box in order to pay the rent, does not have the same weight as capital's consent.

The Board said this twice: in June, for the fingerprint; today, for email. "The worker's consent is not free, because of the imbalance of power." This is the passing into an official text of what the union movement has been saying for a hundred and fifty years. This admission has to be taken seriously. Because where consent is not free, rights can be protected not by the individual contract but only by a collective guarantee. The collective agreement, the union, the workplace representative: all of these are the organisational counterpart of this fact.

A majority vote: the inside of the Board is also a field of struggle

Let us not miss that the decision was taken by majority vote. That is, inside the Board there is also a view that finds these limits too wide and too burdensome for the employer. This tells us two things. First, this gain is not permanent; it can be narrowed in the next composition of the Board. Second, we can expect from now that organisations of capital will object to this decision and will try to narrow its reading on the grounds of "work safety," "information security" and "trade secret." Every article of the law is interpreted again, between the classes, after it is written too.

The limits of the decision: what does it not solve?

Without belittling the gain, let us also see its limits plainly.

The penalty is uncertain, the burden is on the worker. The decision states no specific amount of fine; violations will be assessed "according to the concrete case." In practice this means the worker first applies to the employer, then complains to the Board, and then waits for the process to conclude. For an employee who has lost their job, or who fears losing it, this is a heavy burden. As we reported in the piece on the 80s trend, a significant part of the complaints that reached the Board in 2025 had been rejected on procedural grounds. Procedure is always a wall in front of the unorganised worker.

Who defines "concrete suspicion"? Concrete suspicion is required for access to content; but the one who defines the suspicion in the first instance is again the employer. The risk continues that, in periods of union membership and in organising campaigns, the correspondence of employees declared "suspect" will be entered on the ground of a "concrete claim." This gap can be closed only by the supervision of supervision at the workplace, that is, by the union representative's participation in access decisions.

The public authority is an employer too. The decision does not distinguish the data controller; in principle, employees in public institutions are also within its scope. But a significant part of surveillance in the public sector rests on other legislation, under the headings of "security" and "investigation." If we also recall our doubts about the Board's independence, how far the decision will be applied in public workplaces is a question that has to be watched separately.

The software is already recording everything. Today's workplace software, under names such as "productivity analytics," "employee-experience platform," artificial-intelligence meeting summarisers and automatic analysis of correspondence, already records and processes every interaction. How the Board's ban on "tools that record all transactions without distinction" will be applied to this software will be the decision's real test. To our mind the decision makes the use of these products with their default settings legally indefensible; but what will make the employer say so is, again, the worker's objection. Remember what we wrote on algorithmic domination in the call centres: in the factory behind the headset, even tone of voice is measured.

Working from home carried surveillance into the home. We discussed the remote and hybrid work regulation published at the end of September in the piece "The Factory on the Kitchen Table". For the person working from home, the camera, the microphone and the screen of the work computer are at the same time the inside of the home. The Board's principle of "a narrower reading where use is mixed" gains its value exactly in this situation. This decision has to be put on the table when a remote-work contract is signed.

Surveillance itself is not questioned. The most basic limit is this: the decision regulates surveillance, it does not abolish it. As we said in Whose Eye Are the Glasses?, states and companies are bargaining not over the existence of surveillance, but over in whose hands the control of surveillance will be. In this decision too the employer's power of surveillance is accepted; only its rules are set. Our horizon is further on: the opening of the control of work processes to the common control of those who work at the workplace. Anthropic's activist monitoring system had shown us how the rules are stretched even in the largest companies.

A note for the computing worker: between "I can reach it" and "I may reach it"

One of the silent addressees of this decision is computing workers too. The system administrator, the IT support staff, the security specialist, the programmer: the one who carries out the employer's instruction "pull out that employee's correspondence" is, most of the time, again a worker.

The Board's principle that "the possibility of technical access is not a legal authority of access" is a shield for these workers too. The sentence "my manager asked, I did it" may no longer be legally enough; because the access has to be reasoned, limited and recorded. The computing worker has the right to ask for this, and should ask for it: a written access instruction, with a ground, and with a defined scope. This protects both the colleague and oneself. As we said in The Computing Worker's Handbook, the computing worker is both a part and an object of the surveillance apparatus; being conscious of this double position is the first step in creating a point of resistance inside the apparatus.

Concrete tasks

The decision is an instrument; if the instrument is not used, it rusts. What can we do?

As an employee

Ask for the clarification notice. Ask your employer for the written clarification notice on the supervision of corporate email and communication channels. Check one by one the elements the decision looks for (purpose, scope, method, legal ground, the cases of access to content, the retention period, your rights).
Make an application under Article 11. Article 11 of Law No. 6698 gives the right to learn what data about you is processed, and to whom it is transferred. The data controller, that is the employer, has to reply within 30 days. If no reply is given, or if it is insufficient, the path of complaint to the Board opens.
Separate the personal from the corporate. Do not carry your union correspondence, your health information, or your private life onto work accounts and work devices. This is a precaution of care; it is not a loss of a right. The right will be used when there is a violation.
If correspondence has been made evidence in a dismissal, remind your lawyer of this principle decision and of the Bărbulescu criteria; have them question how the evidence was obtained.

As a union and a workplace representative

An article in the collective agreement. Carry the principles of the decision into the collective agreement. A sample article might be this: "The employer supervises corporate communication channels only by a written decision that is reasoned and of defined scope. The decision to access content is notified to the workplace union representative at the same time. Access records are shared if the union requests them. Secret monitoring and software that records all transactions are not used. Information obtained contrary to these rules cannot be made a ground for discipline or dismissal."
Ask for an inventory of software. Ask for the list of which monitoring, analytics and recording software is used at the workplace. Identify those contrary to the decision's ban on "recording without distinction."
A collective application. Applications one by one can come back on procedural grounds; standard application templates prepared through the union, common files, collective follow-up, are the way to get over this wall.
Training. Organise a short workplace training that tells this decision and the June biometric decision together. You cannot defend a right you do not know.

At the political level

That these principles not remain a principle decision, but enter the Labour Act as an explicit article on workplace surveillance.
Procedural ease in favour of the worker in complaints made to the Board, and the right of unions to collective application and collective lawsuit.
That the data-protection authority be genuinely independent, and that public employers too be supervised by the same criteria.
The obligation that surveillance and artificial-intelligence tools used at the workplace be negotiated with employee representatives before they begin to be used.

Whose is the mailbox?

Dear young comrades, on the first day you start work you are given a computer, an email address and a password. From that day on it is taught that everything you write from that address does not belong to you, that it turns into a file the boss can open and read whenever they wish. This teaching is so settled that most of us do not even question it.

The decision published today is an official objection to this teaching. The server may be the boss's; but the word is the worker's. The company may have opened the account; but the relation that passes through the account belongs to people. Consent is measured not by the signature but by the power relation. And being able to see everything technically does not give the right to look at everything.

Carrying these sentences out of the legal text and into the everyday language of the workplace, into the union's contract, into the worker's own consciousness, is our job. Because if these limits, drawn in June on the fingerprint and in October on email, are not protected by an organised force at the workplace, they will be silently erased in the default settings of the next "productivity" software.

The machine is new, the chain is old. But we are learning to count the links of the chain; we will learn to take them apart together too.

Sources

bianet, "KVKK: The employer cannot supervise the employee's emails without limit", 8 October 2026: bianet.org
Memurlar.net, "KVKK: The employer cannot supervise corporate email without limit", 8 October 2026: memurlar.net
Müşavirler Kulübü, "KVKK Board Decision: The Employer Cannot Supervise Corporate Email Without Limit", 8 October 2026: musavirlerkulubu.com.tr
Personal Data Protection Board, principle decision dated 16.09.2026, No. 2026/2035, Official Gazette, 8 October 2026, issue 33394: resmigazete.gov.tr
İmer Hukuk, "Biometric tracking of working hours: the KVKK principle decision" (decision No. 2026/921, Official Gazette 2 June 2026, issue 33268): imer.av.tr
bianet English, "Tracking employee hours with biometric data deemed unlawful", June 2026: bianet.org
Hukuki Haber, "The monitoring of the employee's communication at the workplace" (Bărbulescu v. Romania, ECtHR Grand Chamber, 5 September 2017): hukukihaber.net
Hukuki Haber, Constitutional Court, C.O.A. application, B. No: 2018/31036, 12 January 2021: hukukihaber.net
Law No. 6698 on the Protection of Personal Data: mevzuat.gov.tr
Knowledge Commons, "KVKK's '80s Trend' Warning and Privacy in the Digital Age", 11 September 2026: bilgimusterekleri.org/en/blog/kvkk80ler
Knowledge Commons, "Whose Eye Are the Glasses?", 7 October 2026: bilgimusterekleri.org/en/blog/gozlukkimingozu
Knowledge Commons, "Anthropic's Activist Monitoring System: The Panopticon's Doorkeeper", 11 September 2026: bilgimusterekleri.org/en/blog/anthropicgozetim
Knowledge Commons, "The Factory Behind the Headset: Algorithmic Domination in Call Centers and Global Resistance", 15 May 2026: bilgimusterekleri.org
Knowledge Commons, "The Computing Worker's Handbook", September 2026: bilgimusterekleri.org/en/blog/bilisimemekcisininelkilavuzu

Tags:#oversight #digitalpanopticon #panopticon #surveillance #labour #class #kvkk