DPA case 0610-32/2021/7 – Violation Found (Slovenia, 2021)

The controller, an eGovernment portal (eUprava), published multiple public documents on its digital bulletin board. These documents published more personal data than what is permitted by national law (Article 96 of the General Administrative Procedure Act. According to this national law, the controller can only publish the following kinds of data: * information on the reasons for public notification, * the authority which has issued the document, * the number, date and type of the document, * the personal name or business name of the addressee, * the address for service or other permanent or temporary residence if the addressee does not have an address for service, * the registered office of the legal person or natural person registered for the performance of activities, * an indication of the administrative case, * the date of publication of the notification with the warning that the addressee is to take delivery within 15 days, * the consequences referred to in paragraph five of this Article, and the place where the document is located. Additionally, the controller published the following personal data (not explicitly permitted by the ZUP): * individuals’ date of birth, * decisions to suspend the procedure for granting international protection, in full. Slovenian DPA held, that the controller (public sector) violated Articles 24 and 25 of the ZVOP-1 and Article 32 of the GDPR. The controller failed to ensure an adequate level of personal data security in order to prevent illegal publication. Author's note: in accordance with the practice of the IP, the controller should protect personal data, the publication of which is not explicitly permitted by law, with a password or in any other appropriate manner. As the controller had already complied with the GDPR during the inspection procedure, the IP stopped further procedure. However, the IP announced that this violation will also be assessed in the context of misdemeanors (seperate procedure).