- Enforcing jurisdiction
- Slovenia · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 07100-15-2023-1 – Complaint Upheld (Slovenia, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Slovenian data protection authority found that a former employer did not fully comply with a public servant's request for access to their personal documents. This is important because it emphasizes that companies must provide complete access to personal data when requested.
What happened
The former employer partially fulfilled a request for access to personal documents but did not provide all requested copies.
Who was affected
A public servant who requested access to documents held by their former employer.
What the authority found
The authority concluded that the employer failed to appropriately respond to the access request, breaching data protection rules.
Why this matters
This ruling stresses the obligation of employers to fully comply with access requests from former employees. Organizations should review their data access policies to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 26 May 2023, the complainant, a public servant, submitted an access request to its former employer, a Slovenian Ministry, (the controller) to obtain copies of all the documents held on her. The controller partially complied with the request and provided the complainant with a list of all the documents it kept. However, it explained that it would not send copies of the documents since the complainant should already be in their possession. Following the controller’s reply, on 3 July 2023, the complainant lodged a complaint with the Slovenian DPA because only part of the documents requested by her were granted. Thus, the DPA provided the controller with the possibility to reconsider the complainant’s request. Following which, the controller granted the complainant’s access request and sent her copies of the documents highlighted in the list first sent to her. After this, the DPA asked the complainant if she wanted to pursue the complaint, to which she replied that not all the documents she had requested and wished to receive were given to her. In this respect, the controller clarified to the DPA that it did provide all the documents in its possession but wanted to check again for further documents. After the review, it did not find any further documents. On 2 October 2023, the DPA again informed the complainant of the controller’s reply, which the complainant did not comment. On the basis of the information provided, the Slovenian DPA concluded that the controller failed to take an appropriate decision on the complainant's access request to personal data at the time of the application, breaching Article 15 GDPR in conjunction with [http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959 Articles 12 and 14 of the Slovenian Data Protection Act (ZVOP-2)], which provide that when a controller deals with a data subject request, it shall inform the individual of the decision and comply with the request within the time limit laid down in the GDPR. The DPA noted that the
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 07100-15-2023-1 in SI
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 07100-15-2023-1 - Slovenia (2023). Retrieved from cookiefines.eu
Last updated: