DPA case 07121-1/2020/1869 – Violation Found (Slovenia, 2020)

On October 9th, a complainant submitted a request to the Slovenian DPA (IP) to ask them whether the complainant was obliged to provide a bank with more accurate information about their assets. The bank had flagged the complainant as a politically exposed person, on the basis of Article 61 of the Act on Prevention of Money Laundering and Terrorist Financing (Slovenian Legislation, ZPPDFT-1). The complainant believed the bank's request was excessive and that there was no basis for processing the data related to his assets. Therefore, the complainant filed a complaint with the DPA. Whether a bank was within its right to request from a data subject who had been flagged as a "politically exposed person" additional information about the nature of their assets. The Anti-Money Laundering and Terrorist Financing Act requires the collection of certain data from politically exposed persons. Article 61, ZPPDFT-1 defines as a politically exposed person any natural person who acts or has acted in a prominent public position in a Member State or a third country in the last year, including his immediate family members (among whom according to the fourth paragraph of the same the spouse or common-law partner, parents and children and their spouses or common-law partners) and close associates. Having regard to this, the Act provides an appropriate legal basis for obtaining statutory personal data from individuals identified by banks as politically exposed persons and their immediate family members in accordance with Article 6(1)(c) GDPR. Article 6(1)(c) stipulates that processing is lawful when it is necessary for compliance with a legal obligation to which the controller is subject to. The DPA held that obtaining legally required information on the assets and origin of assets from an individual identified as a politically exposed person falls within the bank's scope of obligation, based on the Anti-Money Laundering Act. However, the DPA did note that even though the bank had t