DPA case 07120-1/2021/182 – Violation Found (Slovenia, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Slovenian authority found that linking health databases without permission is not allowed. This decision is important because it protects personal health information from being shared without proper consent. Companies handling health data must follow strict rules to ensure privacy.
What happened
The authority determined that connecting health databases requires prior permission.
Who was affected
Individuals whose health data could be linked between different health databases.
What the authority found
The authority ruled that linking the Register of Infectious Diseases to the Cancer Registry without permission is prohibited.
Why this matters
This ruling emphasizes the need for clear permissions when handling sensitive health data. Organizations must be careful to comply with privacy regulations when managing health information.
Source checks
Archived or cached source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
IP received a request for an opinion on the temporary connection of health databases maintained in accordance with the Health Care Databases Act (ZZPPZ), namely the Register of Infectious Diseases (NIJZ48 collection), managed by the National Institute of Public Health (NIJZ) and the Cancer Registry (NIJZ25 collection), managed by the Oncology Institute Ljubljana. The client explained that data on the presence of an infectious disease in cancer patients are crucial for determining the causes of cancer and for determining deviations from the intended treatment of oncological disease, i.e. for evaluating oncological care. The linking of the Registry of Infectious Diseases to the Cancer Registry is (according to Article 84/3 of the Slovenian Personal Data Protection Act) not allowed without the prior permission of the IP.
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 07120-1/2021/182 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 07120-1/2021/182 - Slovenia (2021). Retrieved from cookiefines.eu
Last updated: