DPA case 0611-182/2021/23 – Violation Found (Slovenia, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Slovenian company was inspected for its video surveillance practices. The company argued that its surveillance was necessary for safety, but the DPA found that it needed to ensure compliance with data protection rules.
What happened
The Slovenian DPA inspected a company regarding its video surveillance practices.
Who was affected
Employees and visitors at the company's premises who were monitored by the surveillance cameras.
What the authority found
The DPA concluded that the company must ensure its surveillance practices comply with GDPR and local laws.
Why this matters
This inspection highlights the importance of transparency and compliance in surveillance practices. Companies should regularly review their policies to ensure they respect privacy rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
This decision is based on an inspection procedure done by the Slovenian DPA, where a company (the controller) was requested to provide answers, on 8 July 2021, 19 August 2021 and 25 October 2021, to the questions concerning the lawfulness of the video surveillance carried out by the controller over their premises and the surrounding area. The controller stated that video surveillance was introduced to ensure the protection of property and the safety of persons per the controller's legitimate interest according to Article 6(1)(f) GDPR. It further explained that the surveillance occurred in accordance with [https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2004-01-3836/zakon-o-varstvu-osebnih-podatkov-zvop-1?h=zvop-1 Articles 75 and 77 of the Personal Data Protection Act] (Zakon o varstvu osebnih podatkov - ZVOP-1) because it was impossible to do it in a less restrictive way. Additionally, it put security systems in place: access to archives of videos was password-protected, limited to certain persons and only accessed in exceptional cases, e.g. to provide evidence in criminal proceedings. The controller stated that they informed the representative trade union and gave reasons as to why the cameras were installed, which the trade union supported. The controller also informed their employees about the installation of the video surveillance system by posting it on the company's notice board. Hence, the controller believed that the surveillance complied with the rules on video surveillance, could be based on Article 6(1)(f) GDPR, and complied with [https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2004-01-3836/zakon-o-varstvu-osebnih-podatkov-zvop-1?h=zvop-1 Articles 3, 24 and 74 ZVOP-1] and [http://www.pisrs.si/Pis.web/pregledPredpisa?id=USTA1 Article 38 of the Slovenian Constitution]. During the course of their inspection visit, the DPA also found that CCTV cameras were installed in a way that covered almost the entire premises of the controller, incl
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 0611-182/2021/23 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 0611-182/2021/23 - Slovenia (2023). Retrieved from cookiefines.eu
Last updated: