DPA case 06111-1/2023/8 – Dismissed (Slovenia, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Slovenian DPA dismissed a complaint regarding a spam SMS received after a legitimate message from a company. The DPA found that the phone number in question was not personal data because it was associated with a legal entity. This case clarifies what constitutes personal data.
What happened
A complaint about receiving spam SMS after a legitimate message was dismissed by the DPA.
Who was affected
The complainant who received the spam SMS after a legitimate shipping notification.
What the authority found
The DPA concluded that the phone number did not qualify as personal data under GDPR.
Why this matters
This ruling clarifies the definition of personal data, which can help businesses understand their obligations regarding data protection.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 17 January 2023, the complainant received an SMS message from the controller regarding certain shipping information. 15 minutes after this first SMS message, the complainant received a spam SMS message from an unknown sender. Because of this, on 26 January 2023, the complainant lodged a complaint with the Slovenian DPA. It claimed that the controller did not adequately secure his phone number, a personal data, and did not take all measures to prevent their unauthorized use, as a result of which it received a spam SMS message. The Slovenian DPA initiated proceedings against the controller and, on 10 March 2023, the DPA sent a request for clarification to the controller regarding the allegations. The controller explained that the disputed telephone number had been provided by another company, which had to deliver an item to the complainant. It further stated that it does protect the shipment data it receives and does monitor its systems carefully, but in this instance, the phone number was publicly posted on several websites of different companies engaged in logistics activities. Following the information provided, the DPA reiterated that the telephone number of a natural person is generally considered personal data, but not when it belongs to a legal entity. In order to be "personal" in accordance with Article 4(1) GDPR, data must meet two conditions cumulatively: (i) the information must refer to an individual (a natural person) who (ii) must be specified or identifiable. In the present instance, since the controller processed the phone number in relation to a legal person and the telephone number in question related to a company, the DPA concluded that the telephone number in question did not constitute personal data within the meaning of Article 4(1) GDPR. As a consequence, the processing of the contested personal data was not subject to Article 2(1) GDPR, and the controller did not violate Article 32 GDPR as the security of processing obligations were not applicable.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 06111-1/2023/8 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 06111-1/2023/8 - Slovenia (2023). Retrieved from cookiefines.eu
Last updated: