DPA case 07121-1/2020/701 – Order (Slovenia, 2020)

The IP received a request to issue an opinion on whether the data regarding the appointment of a researcher and the invalidity of the research title are personal data and as such are inaccessible to the Scientific Council of a public institute. The question arose from the fact that the Scientific Council incorrectly named a particular researcher due to lack of access to his personal data. The IP found that the processing of the personal data of researchers by the public institute as controller or the Scientific Council as its expert body may be permissible under Article 6 (1)(e) GDPR in the election to the research title as public task. It added that researchers employed by the public institute are civil servants, thus names and other data related to their employment constitute freely available, public information. It follows that the data on a (valid) research title of a researcher employed by a public institute is probably not personal data at all. However, a concrete and definitive assessment falls under the responsibility of the controller. Pursuant to the Article 25(2) ZVOP-1, the data controllers determine procedures and measures for the protection of personal data and designate the persons responsible for certain files with personal data and persons who process certain data. IP sees in principle no obstacles to the access to the personal data at stake. However, the final assessment of the personal data that can be processed and the respective legal basis has to be made by the data controller.