DPA case 07121-1/2020/197 – Order (Slovenia, 2020)

The IP received a request for an advisory opinion regarding the processing of data in the context of a life insurance policy. The IP found that pursuant to the Insurance Act the insurance companies and the Slovenian Insurance Association maintain individual databases of personal data referred to therein. Such a database could also be one of potential policyholders and insured persons in which the personal data provided for in this Act may be collected from a customer, taking into account the purpose of data processing. This personal data is therefore collected directly from the data subjects (customers). The insurer must therefore obtain the information from the customer, not itself. The processing of personal data in this database is only allowed to the extent that is necessary for the purposes of processing defined in the law. Therefore, the insurance companies have a legal basis for obtaining and processing personal data to the extent and for the purposes defined in the law. However, the IP stressed that the principle of data minimisation must be respected, so that only personal data should be processed as is strictly necessary for the exercise of legitimate powers, tasks or obligations. Specific retention periods are also provided for in the same Act, after which the personal data included in the database must be erased, destroyed or irrevocably anonymized. Further, the insurance companies have a duty to confidentiality according to the same Act. Finally, the IP concluded that it is not possible, in the context of a non-binding opinion, to determine whether, in a particular case the stated conditions for processing all the information are fulfilled. This should be done by the operator. The IP can go through a specific assessment of the legality of processing in a particular case only by an inspection or administrative procedure.