DPA case 0712-1/2019/2504 – Order (Slovenia, 2019)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Slovenian authority advised on what personal data a bank can collect when opening a deposit account. This matters because it helps banks understand what information is necessary and what might be excessive. Businesses should be careful not to collect more data than needed for their services.
What happened
The DPA provided an opinion on the types of personal data a bank can lawfully collect for opening a deposit account.
Who was affected
Bank customers who are opening deposit accounts were affected.
What the authority found
The DPA indicated that collecting excessive personal data, like marital status, may not be justified for the purpose of opening an account.
Why this matters
This guidance helps set boundaries on data collection practices. Companies should evaluate their data collection to ensure it aligns with legal requirements.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Archived or cached source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The IP received a request for an advisory opinion on the question which personal data could a bank lawfully collect for the purpose of opening a deposit account. Such an account would constitute a contract between the bank and the data subject. The DPA pointed out that the processing of personal data such as the marital and employment status could be excessive with regard to the purpose of creating a deposit account. In any case, the DPA stressed that the bank has to provide information on the legal basis and the purposes of processing.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0712-1/2019/2504 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0712-1/2019/2504 - Slovenia (2019). Retrieved from cookiefines.eu
Last updated: