Úrad na ochranu osobných údajov Slovenskej republiky (ÚOOÚ) – Court Ruling (Slovakia, 2026)

The DPA carried out an ex officio inspection of the Rajec’s City Council, the controller, concerning its processing of personal data through a CCTV system. On 27 August 2019, the DPA issued a first-instance decision imposing a €10,000 fine and corrective measures. Following an appeal by the controller, the DPA issued a second-instance decision on 29 November 2019. It partially amended the first-instance decision and reduced the fine to €9,000. The DPA found that the controller had violated the principle of transparency under Article 5(1)(a) GDPR by failing to specify the legal basis for CCTV processing in its records of processing activities and by failing to provide information to data subjects before they entered the monitored area. The DPA also found a violation of the storage limitation principle under Article 5(1)(e) GDPR. According to the DPA, the controller retained CCTV footage for longer than necessary. Although the controller had set a seven-day retention period, the inspection found one recording that had been retained for around 20 days. The controller challenged the DPA’s decision before the administrative court. It argued, among other things, that its records of processing activities referred to relevant national laws and that the GDPR did not require a precise citation of Article 6 GDPR in such records. It also argued that, at the time of the inspection, there were no binding rules on how CCTV information notices had to be provided, and that the single over-retained recording was a one-off human error without consequences for data subjects. During the court proceedings, the Administrative Court of Bratislava examined whether the operative part of the DPA’s decision met the requirements applicable to administrative penalties. The court focused on whether the alleged infringements were described with sufficient precision in terms of the act, time, place and manner of commission. The court annulled the DPA’s decision and remanded the case. The court held that, in administrative penalty proceedings, the operative part of a decision must clearly and precisely identify the conduct for which the sanction is imposed. This follows from the right of defence and the principles of criminal procedure that apply, by analogy, to administrative penalties. The court found that the DPA’s decision did not meet this standard. First, the operative part merely stated that the controller had failed to specify the legal basis for CCTV processing in its records of processing activities. However, the reasoning and administrative file showed that the controller had in fact mentioned certain legal bases, while the DPA considered them insufficient or incorrect. The court noted that this distinction was legally relevant, since an incorrect or missing entry in records of processing activities may amount to an Article 30 GDPR issue, whereas processing without a legal basis concerns the lawfulness of processing under Article 6 GDPR and may fall under a different sanctioning framework. Second, the court held that the DPA had not sufficiently specified the alleged failure to provide information to data subjects. The operative part did not identify which CCTV cameras, which monitored areas or which specific information notices were concerned. The fact that some of these details appeared in the reasoning, the inspection report or later submissions was not sufficient, since the operative part itself must contain the essential factual definition of the offence. Third, the court found that the alleged storage limitation infringement was also insufficiently specified. The operative part did not clearly state which personal data were retained for too long, whether the issue concerned CCTV footage or other data, whether it concerned one recording or several, or whether the DPA considered the controller’s seven-day retention period itself unlawful or only the single 20-day retention incident. Because of these deficiencies, the court considered the DPA’s decision incomprehensible and non-reviewable. It therefore could not assess the substantive GDPR issues or the proportionality of the fine. The DPA must issue a new decision, if it continues the proceedings, clearly defining the specific conduct, place, time and manner of the alleged infringements.