- Enforcing jurisdiction
- Slovenia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case SI – 07101-5-2023-16 – Complaint Upheld (Slovenia, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Slovenia's data protection authority found that the police did not provide complete information when a person requested access to their data. This is important because it reinforces the right of individuals to know how their data is being used.
What happened
The police refused to provide details about their processing logs and record of processing activities when requested.
Who was affected
Individuals whose data is processed by the Slovenian police.
What the authority found
The authority determined that the police violated GDPR rules by not providing necessary information about data processing.
Why this matters
This ruling emphasizes the need for transparency in data processing. Organizations must be ready to provide complete information when individuals request access to their data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 17 January 2023, the data subject made an access request to Slovenia’s General Police Directorate (the controller) and requested a copy of the record of processing activities and the controller's processing log, under Article 15 GDPR. As the controller is the Slovenian Police, the log file is a database of criminal offences committed by data subjects, photographs, fingerprints and DNA tests, but also includes information on processing operations that are not related to criminal law. On 2 February 2023, the controller responded providing the data subject with their criminal record, offence record, photographic records, fingerprint data and DNA examination record. However, the controller refused to provide information relating to the record of processing activities and also refused to provide information concerning their processing logs. On 24 February 2023, the data subject lodged a complaint with the Slovenian DPA concerning the controller’s refusal to provide information for their processing logs and record of processing activities. The complaint was limited to the controller's refusal to provide information regarding the purposes and the date/time of processing from the logs, and not the names of internal users. The Slovenian DPA held that the controller was in violation of Article 15(1)(a) GDPR, as the purposes of processing of the logs fell within the scope of Article 15(1)(a) GDPR. The Slovenian DPA considered that the information regarding the time of processing was necessary to understand the information about the purpose of the processing and to achieve the objectives of the right of access. They noted that the right to be informed about the processing of personal data does not explicitly include information about the duration of the processing, but nonetheless, it should be considered an essential part of the information about the processing of personal data. In addition, the DPA following the EDPB’s Guidelines ([https://edpb.europa.eu/system/fil
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case SI – 07101-5-2023-16 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case SI – 07101-5-2023-16 - Slovenia (2023). Retrieved from cookiefines.eu
Last updated: