DPA case 0712-1/2019/2419 – Order (Slovenia, 2019)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Slovenian authority could not answer a question about who is responsible for processing children's personal data when a third-party service provider collects it. This matters because it highlights the need for clear guidelines on data handling, especially when it involves children. Companies should ensure they understand their roles in data processing to comply with privacy laws.
What happened
The Slovenian DPA was asked to clarify the roles of a service provider and a company in processing children's personal data.
Who was affected
Children whose personal data is collected by a third-party service provider for organizing trips were affected.
What the authority found
The DPA stated it could not provide a clear answer due to insufficient information but emphasized the need for both parties to secure personal data transfers.
Why this matters
This situation shows the complexities of data processing roles and the importance of having clear agreements. Companies should review their data handling practices to ensure compliance.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Archived or cached source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The legal entity which requested the opinion is a third party service provider which collects through parents and the service provider, the children’s personal data for the purpose of organising trips. The legal entity receives and collects the information necessary for the signature of the contract and then transfers the personal data to the service provider with which the parents sign the contract. The IP’s opinion pursuant to Article 58(3) GDPR has been requested in order to find out who is considered to be a processor, a controller and what the legal basis for the processing of the children’s personal data is. More precisely, the question was raised whether the processing is carried out on behalf of the service provider as a controller or if the third party service provider is processing the personal data for its own purposes. The Slovenian DPA stated it was not able to answer to the question due to lack of information. Nevertheless, it stated that both the controller and the processor have to apply the necessary measures to secure the transfer and to prevent unauthorised personal data disclosures.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0712-1/2019/2419 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0712-1/2019/2419 - Slovenia (2019). Retrieved from cookiefines.eu
Last updated: