DPA case 0611-623/2021/10 – Violation Found (Slovenia, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Slovenian data protection authority found that a SARS-CoV-19 test station did not inform individuals about data transfers to a central health register. This lack of transparency is a violation of data protection rules. Companies must keep users informed about how their data is used.
What happened
The test station failed to inform individuals that their personal data was being transferred to a central health register.
Who was affected
Individuals who underwent SARS-CoV-19 testing at the facility.
What the authority found
The authority determined that the test station violated data protection rules by not providing necessary information about data transfers.
Why this matters
This case highlights the need for transparency in data handling. Businesses must communicate clearly with users about how their data is processed and shared.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller, a private entity, operated as a SARS-CoV-19 test station. The legal basis for the processing of personal data of individuals for the purpose of carrying out SARS-CoV-2 self-testing procedures is Article 6(1)(c) GDPR (the necessity to comply with a legal obligation) and Article 9(2)(h) GDPR, in conjunction with Article 14c of the Act on Databases in the Field of Healthcare (Zakon o zbirkah podatkov s področja zdravstvenega varstva - ZZPPZ). While a contractual relationship existed between the data subject and the the person ordering the testing, the ZZPPZ establishes the obligation to transfer the data to the Central Register of Patients' Data (CRPP) for the purpose of carrying out the testing for the presence of the SARS-CoV-2 virus. According to Article 14č of the ZZPPZ, the information shall be transferred to the CRPP as soon as it arises or is received in the course of the provision of health care, but at the latest by the end of the working day. The data subjects were not aware of these data transfers. The DPA held that by not informing data subjects of the data transfers, the controller had violated Article 5, Article 12 and Article 13 GDPR. Therefore, the DPA ordered the controller to provide all the information referred to in Article 13(1) and Article 13(2) GDPR in a concise, transparent, comprehensible and easily accessible form and in clear and plain language. This should be done in the usual manner of notification, such as a general notice on a notice board at their premises or before entering the facility where the testing is carried out, or on the controller's website. The DPA also found that the controller had a legal basis to obtain the name, mobile telephone number and health card number or health insurance card details of each individual who came for a test, as it was required to provide this information to the CRPP. The DPA, however, found that the controller did not have a legal basis for collecting email addresses from all per
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0611-623/2021/10 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0611-623/2021/10 - Slovenia (2022). Retrieved from cookiefines.eu
Last updated: