- Enforcing jurisdiction
- Slovenia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 07121-1/2020/2187 – Violation Found (Slovenia, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Slovenian insurance company was found to have a legal basis for accessing medical records under the Slovenian Insurance Act. This ruling clarifies that companies can obtain necessary medical documentation without needing consent if it's required for insurance purposes. This matters because it sets guidelines for how personal data can be processed in the insurance industry.
What happened
The court confirmed that an insurance company can access medical documentation without consent when it's necessary for processing insurance claims.
Who was affected
Individuals whose medical records were accessed by the insurance company.
What the authority found
The authority ruled that the insurance company had a valid legal basis for processing personal data under the Slovenian Insurance Act.
Why this matters
This decision highlights the balance between privacy and the needs of the insurance industry. Companies should ensure they understand the legal bases for accessing personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
According to the complainant, the Slovenian Insurance Act allows an insurance company to obtain medical documentation from a healthcare provider but only to the scope where it is necessary and appropriate to achieve the purposes of processing. In all other cases, the company should obtain a written consent from an insured person. Does Article 268 of the Slovenian Insurance Act constitute appropriate legal basis of accessing to medical documentation by an insurance company? IP clarified that the controller must have a legal and appropriate legal basis for any processing of personal data, including their disclosure through transmission or dissemination. IP emphasized that it is sufficient for the lawfulness of the processing that one of the separate legal bases set out in Article 6 (1) in conjunction with Article 9 (2) of the General Regulation is met. This means that if the controller processes personal data e.g. by law, he is not obliged to obtain consent for this information. The legal basis for the transmission of personal data to an insurance company is given in Article 286 of the Insurance Act. The insurance company is entitled to obtain relevant medical documentation relating to the insured or the beneficiary from the insurance if this documentation is necessary for concluding and implementing insurance contracts, recovery of unpaid liabilities from insurance contracts, settling claims, claiming claims and other rights and obligations, including the investigation of suspicious cases of unduly paid compensation or insurance benefits arising from insurance under this Act, and verification of political exposure of persons under the Act governing the prevention of money laundering and terrorist financing (third paragraph of Article 268 of ZZavar-1). The insurance company is therefore entitled, inter alia, to the documentation required for: - taking out insurance, e.g. in the case of a medical examination before taking out life insurance, - deciding on an ins
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 07121-1/2020/2187 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 07121-1/2020/2187 - Slovenia (2020). Retrieved from cookiefines.eu
Last updated: