- Enforcing jurisdiction
- Slovenia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 0611-10/2021/11 – Violation Found (Slovenia, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Slovenian authority found that a bar was improperly using video surveillance and ordered it to adjust its cameras. This is significant because it shows that businesses must limit surveillance to protect customer privacy.
What happened
The bar was found to be monitoring areas beyond what was necessary for security.
Who was affected
Customers and staff at the bar who were recorded by the surveillance cameras.
What the authority found
The authority determined that the bar did not have a legitimate interest in monitoring certain areas with video surveillance.
Why this matters
This ruling highlights the need for businesses to ensure their surveillance practices comply with data protection principles, particularly regarding data minimization.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
During the inspection procedure, the IP established that the controller was carrying out video surveillance at a bar. An outdoor camera recorded the entrance and the outdoor terrace. The first indoor camera captured the server rooms and the bar counter and the right side of the building. The second indoor camera captured the server rooms and the left side of the facility. The Slovenian DPA (IP) held that a bar owner does not have a legitimate interest in monitoring the various server rooms and outdoor terrace of the bar with video surveillance, but does have a have a legitimate interest in monitoring the bar counter (where bottles of higher value and the cash register are contained) and the bar entrance. Accordingly, the DPA gave the bar fifteen days to adjust the viewing angles of its surveillance cameras to record only the counter and entrance. The DPA explained that video surveillance is the processing of personal data (Article 4(2) GDPR) and the operator of video surveillance is responsible for complying with the principles set out in Article 5 GDPR, including data minimization, purpose limitation and storage limitation. In assessing the adequacy of procedures and measures to ensure an adequate level of security of personal data, the bar must also comply with Article 32 GDPR, which provides that controllers and processors shall ensure a level of data security appropriate to risks to the rights and freedoms of individuals by, for example, endeavoring to maintain the confidentiality of data subjects. According to national law (ZVOP-1), video surveillance of a business premises may be carried out for the safety of people or property, to ensure control of entry into or exit from or from business or business premises, or if, due to the nature of the work, there is a possibility of endangering employees. Thus, the bar has a legitimate interest, as recognized in Article6(1)(f) GDPR, in processing data limited to those purposes. In contrast, there is no provision al
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0611-10/2021/11 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0611-10/2021/11 - Slovenia (2021). Retrieved from cookiefines.eu
Last updated: